Description
PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith() method to the _safe_getattr wrapper, achieving arbitrary OS command execution on the host. This issue has been patched in version 1.5.90.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| MervinPraison | PraisonAI | affected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-6vh2-h83c-9294 | PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code |
References
History
Sat, 04 Apr 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith() method to the _safe_getattr wrapper, achieving arbitrary OS command execution on the host. This issue has been patched in version 1.5.90. | |
| Title | PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code | |
| Weaknesses | CWE-693 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-03T22:51:28.199Z
Reserved: 2026-03-31T17:27:08.660Z
Link: CVE-2026-34938
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-03T23:17:06.170
Modified: 2026-04-03T23:17:06.170
Link: CVE-2026-34938
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses