PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command>'. This issue has been patched in version 4.5.97.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-r4f2-3m54-pp7q | PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 04 Apr 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command>'. This issue has been patched in version 4.5.97. | |
| Title | PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox | |
| Weaknesses | CWE-78 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-03T23:04:25.792Z
Reserved: 2026-03-31T17:27:08.662Z
Link: CVE-2026-34955
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-04T00:16:19.370
Modified: 2026-04-04T00:16:19.370
Link: CVE-2026-34955
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses