CVE-2026-39888
Sandbox Escape in PraisonAI Python Tools Enables Code Execution
Publication date: 2026-04-08
Last updated on: 2026-04-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| praison | praisonai | to 1.5.115 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
| CWE-657 | The product violates well-established principles for secure design. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in PraisonAI, a multi-agent teams system, specifically in the execute_code() function of praisonaiagents.tools.python_tools before version 1.5.115. The function runs user code in a subprocess with a restricted builtins dictionary and an AST-based blocklist to limit dangerous operations. However, the subprocess blocklist only blocks 11 attribute names, missing four critical attributes (__traceback__, tb_frame, f_back, and f_builtins) that allow an attacker to traverse the frame stack.
By chaining these unblocked attributes through a caught exception, an attacker can access the real Python builtins dictionary of the subprocess wrapper frame. From there, they can retrieve and call the exec function under a non-blocked variable name, effectively bypassing all remaining security layers and escaping the sandbox restrictions.
This vulnerability was fixed in version 1.5.115.
How can this vulnerability impact me? :
This vulnerability allows an attacker to escape the sandbox environment intended to restrict user code execution. By bypassing the sandbox, the attacker can execute arbitrary Python code with the privileges of the subprocess.
The impact includes complete compromise of confidentiality, integrity, and availability of the system running PraisonAI, as indicated by the CVSS score of 9.9 with high impact on confidentiality, integrity, and availability.
- Execution of arbitrary code beyond intended restrictions.
- Potential unauthorized access to sensitive data.
- Possible disruption or damage to system operations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade PraisonAI to version 1.5.115 or later, where the issue is fixed.