CVE-2026-34938 - Vulnerability Analysis

Overview

PraisonAI praisonai-agents < 1.5.90 contains a command injection caused by sandbox bypass via a str subclass with overridden startswith() in _safe_getattr, letting attackers execute arbitrary OS commands, exploit requires crafted str subclass.

Severity & Score

Impact

Attackers can execute arbitrary OS commands on the host, leading to full system compromise.

Mitigation

Update to version 1.5.90 or later.

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294

Social Media Activity(1 post)

OffSequence

@offseq

Apr 4, 2026

🚨 CRITICAL: CVE-2026-34938 in PraisonAI <1.5.90 lets attackers bypass sandbox protections and achieve arbitrary OS command execution. Immediate upgrade to v1.5.90+ required. Full system compromise possible. https://radar.offseq.com/threat/cve-2026-34938-cwe-693-protection-mechanism-failur-01ac669c #OffSeq #CVE202634938 #infosec #PraisonAI

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner