Arbitrary OS Command Execution Vulnerability in PraisonAI Multi-Agent System

CVE-2026-34937

What is CVE-2026-34937?

PraisonAI, a multi-agent team system, contains a vulnerability that allows arbitrary OS command execution. The flaw arises from the run_python() function, which constructs a shell command string by interpolating user-controlled code into a Python command executed in a subprocess. The existing escaping logic only accounts for specific characters, failing to adequately sanitize the input and allowing attackers to exploit unescaped command substitutions. This vulnerability can lead to severe security ramifications, enabling potential attackers to execute arbitrary commands on the underlying operating system prior to the invocation of Python. This issue was resolved in version 1.5.90.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References