{"data":{"id":"5d31a518-098a-45b2-be56-1396e477895a","title":"GHSA-6vh2-h83c-9294: PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code","summary":"The execute_code() function in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox. Passing a str subclass with an overridden startswith() method to the _safe_getattr wrapper bypasses the sandbox, allowing arbitrary OS command execution on the host as the process user. Deployments using bot.py, autonomy_mode.py, or bots_cli.py set PRAISONAI_AUTO_APPROVE=true by default, so the tool can fire without human confirmation when triggered via indirect prompt injection.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-6vh2-h83c-9294","publishedAt":"2026-04-01T23:17:48.000Z","cveId":"CVE-2026-34938","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["praisonaiagents@<= 1.5.89 (fixed: 1.5.90)"],"affectedPackageNames":["praisonaiagents"],"affectedPackageRefs":["pypi:praisonaiagents"],"affectedVendors":[],"affectedVendorsRaw":["PraisonAI","praisonai-agents"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.13398,"epssCheckedAt":"2026-11-14T00:05:44.059Z","kevDateAdded":null,"advisoryAliases":["GHSA-6vh2-h83c-9294"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-01T23:17:48.000Z","fixReleasedAt":"2026-03-31T10:01:05.646Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:39:03.173Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"praisonaiagents","fixedVersion":"1.5.90","matchedVersion":"1.5.90","fixReleasedAt":"2026-03-31T10:01:05.646Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:39:03.022Z"}]}}