CVE-2026-34937 is a high severity OS command injection in praisonaiagents, the PraisonAI multi agent library. NVD scores it 7.8. The run_python helper builds a shell command from code it is given. Upgrade to praisonaiagents 1.5.90 or later. Pin the fixed version and keep untrusted input away from run_python.
What's affected
praisonaiagents before 1.5.90. The fixed release is 1.5.90.
The record says the run_python function in praisonai builds a command string, interpolates user controlled code into it and runs it with shell=True. The vector is local, so it matters most where untrusted text can reach that function, for example through an agent that accepts input from users.
How to check if you're exposed
Check the installed version:
pip show praisonaiagents
Find every environment that has it, including notebooks, containers and CI images:
pip list 2>/dev/null | grep -i praisonai
Then search your code for calls to run_python and ask whether untrusted input can reach it.
What to do now
- Upgrade with
pip install -U praisonaiagentsand confirm the version is 1.5.90 or later. - Pin the fixed version in your requirements or lock file.
- Review agents that execute generated or user supplied code, and run them in a container or sandbox with no secrets mounted.
- Scan your dependency manifests so the next advisory for an agent framework is matched to the environments that use it.
Why it matters
The weakness is CWE-78, OS command injection. The record explains that the escaping logic only handled backslashes and double quotes. Other shell features such as command substitution were left alone, so a command could run before Python even started.
The lesson is general: escaping strings for a shell is fragile. Passing arguments as a list and avoiding shell=True removes the problem class. Agent frameworks add risk because the input often comes from a model or a user.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Agent code paths that run generated Python are a natural target, because the whole point of the feature is to execute text. Even with the fix, running such code outside a locked down container is a choice to review. Give the process no cloud credentials, a read only file system where possible, and no route to internal services. Those limits keep a future bug in the same area from becoming a full compromise.
Try it yourself
A check on pull requests keeps a vulnerable pin from landing in the first place. This demo shows one.
Click through it at your own pace, or open it full screen.
Quick check
Is this remotely exploitable?
The vector is local with low privileges. It becomes remote in practice if your app passes outside text to the vulnerable function, so check how it is used.
Does the free scan cover Python packages?
The free in-browser scan at https://gold.safeguard.sh/scan checks dependency manifests for known issues. Try it on your requirements file.
Sources
Last reviewed: 19 October 2026.
