Python Regular Expression Vulnerability in PraisonAI by Mervin Praison

CVE-2026-34939

What is CVE-2026-34939?

PraisonAI, a multi-agent system developed by Mervin Praison, has a vulnerability in the MCPToolIndex.search_tools() function where it compiles user-supplied strings as Python regular expressions without any validation or sanitization. This flaw can lead to catastrophic backtracking within the regex engine, which can block the Python thread and result in significant service interruptions. The issue has been addressed in version 4.5.90, highlighting the importance of input validation in preventing such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References