CriticalVulnerability
GHSA-6vh2-h83c-9294: PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
- Identifiers
- CVE-2026-34938GHSA-6vh2-h83c-9294
- Published
- Record updated
- Affected
- praisonaiagents <= 1.5.89
- Fixed in
- 1.5.90
- released March 31, 2026, 1 day before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 13.4%
Summary
The execute_code() function in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox. Passing a str subclass with an overridden startswith() method to the _safe_getattr wrapper bypasses the sandbox, allowing arbitrary OS command execution on the host as the process user. Deployments using bot.py, autonomy_mode.py, or bots_cli.py set PRAISONAI_AUTO_APPROVE=true by default, so the tool can fire without human confirmation when triggered via indirect prompt injection.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- MediumARTEX and beyond: AI-enabled penetration testing platformsSimilar attack · Cisco Talos Blog
- InfoHow AI is changing the nature of cyberattacksSimilar attack · CSO Online
- MediumInside the loop: Five AI attack frameworks that never ask permissionSimilar attack · Elastic Security Labs
- MediumARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.Similar attack · StepSecurity Blog
- MediumFBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video CallsSimilar attack · The Hacker News