CVE-2026-34938: PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code

April 1, 2026 (updated April 6, 2026)

execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith() method to the _safe_getattr wrapper, achieving arbitrary OS command execution on the host.

References

github.com/MervinPraison/PraisonAI
github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6vh2-h83c-9294
github.com/advisories/GHSA-6vh2-h83c-9294
nvd.nist.gov/vuln/detail/CVE-2026-34938

Code Behaviors & Features

Detect and mitigate CVE-2026-34938 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →