CVE-2026-34955 is a high severity command injection in PraisonAI. NVD scores it 8.8. The SubprocessSandbox runs commands with shell=True and only blocks listed strings, so it can be escaped, even in STRICT mode. Upgrade to praisonai 4.5.97 or later. Do not treat the sandbox as a security boundary until you upgrade.
What's affected
praisonai before 4.5.97. The fixed release is 4.5.97.
The record says all modes of SubprocessSandbox are affected: BASIC, STRICT and NETWORK_ISOLATED. Note this is the praisonai package, which is separate from praisonaiagents in CVE-2026-34937.
How to check if you're exposed
Check the installed version:
pip show praisonai
Search your code for SubprocessSandbox and note which agents use it and what input reaches it.
What to do now
- Upgrade with
pip install -U praisonaiand confirm 4.5.97 or later. - Do not treat SubprocessSandbox as a security boundary on older versions. Run untrusted code in a container or VM with limited permissions.
- Remove secrets, tokens and mounted volumes from the environment where agents run commands.
- Pin the fixed version in your lock file.
Why it matters
The weakness is CWE-78, OS command injection. The sandbox relies on string pattern matching to block dangerous commands. The record notes that sh and bash were not on the blocklist as standalone executables, so wrapping a command in a shell invocation gets past it in STRICT mode.
Blocklists are hard to get right because the shell offers many ways to say the same thing. An allowlist or an operating system level boundary is more reliable than matching strings.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Many teams add a sandbox so they can run agent generated commands with some comfort. This CVE is a reminder to test that comfort. If your agents execute commands, ask what would happen if one command string were hostile, and make sure the answer does not depend on a blocklist. Container limits, dropped capabilities and no mounted secrets are sturdier than pattern matching.
Quick check
Is STRICT mode safe on old versions?
No. The record says the escape works in STRICT mode, so do not rely on any mode before 4.5.97.
Sources
Last reviewed: 19 October 2026.
