The SubprocessSandbox component uses subprocess.run(..., shell=True) and relies on a string‑pattern blocklist that excludes sh or bash when invoked as standalone executables. This omission allows an attacker to execute arbitrary host commands such as sh -c '<command>' in STRICT mode. Based on the description, it is inferred that this capability permits the attacker to run any command on the host, potentially compromising confidentiality, integrity, and availability.

The flaw exists in PraisonAI from MervinPraison. All releases older than version 4.5.97 are vulnerable; the issue is fixed in version 4.5.97 and later.

The CVSS score of 8.8 indicates a high severity, while an EPSS score of less than 1 % implies that exploitation is currently unlikely on a broad scale. The vulnerability is identified as CWE‑78 (OS Command Injection). The likely attack vector is via an attacker supplying a malicious command string to the sandbox’s subprocess call; this inference comes from the description that the escape can be achieved with sh -c '<command>'. Therefore, the risk is significant if the attacker can influence the sandbox input or has local access to the environment.