PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935) - ATR-2026-00540 (91a7558d-8cb8-5c2e-a92c-268a4453bb80)
Detects CVE-2026-34935 (CVSS ~9.8 CRITICAL, CWE-78 / GHSA-9qhq-v63v-fv3j): PraisonAI 4.5.15–4.5.68 passes the --mcp CLI argument directly to parse_mcp_command(), which calls shlex.split() and then anyio.open_process() without any validation. An attacker-controlled --mcp value containing a shell interpreter with an inline-exec flag (-c, -e, --exec) or shell metacharacters reaches the OS as a live subprocess, enabling arbitrary code execution.
PoC payloads: --mcp "bash -c 'cat /etc/passwd'" and --mcp "python -c 'import os; os.system(\"id\")'"
Detection covers: (a) --mcp argument values containing a shell interpreter with inline-exec flag; (b) --mcp values with shell metacharacters (pipe, ampersand, backtick, $()); (c) praisonai CLI invocations with subprocess execution primitives in --mcp.
Complements ATR-2026-00531 (PraisonAI HTTP API auth bypass) and ATR-2026-00528 (PraisonAI AUTH_ENABLED hardcoded default).