Executive Summary

This vulnerability exists in PraisonAI, a multi-agent teams system, specifically in the execute_code() function of praisonaiagents.tools.python_tools before version 1.5.115. The function runs user code in a subprocess with a restricted builtins dictionary and an AST-based blocklist to limit dangerous operations. However, the subprocess blocklist only blocks 11 attribute names, missing four critical attributes (__traceback__, tb_frame, f_back, and f_builtins) that allow an attacker to traverse the frame stack.

By chaining these unblocked attributes through a caught exception, an attacker can access the real Python builtins dictionary of the subprocess wrapper frame. From there, they can retrieve and call the exec function under a non-blocked variable name, effectively bypassing all remaining security layers and escaping the sandbox restrictions.

This vulnerability was fixed in version 1.5.115.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to escape the sandbox environment intended to restrict user code execution. By bypassing the sandbox, the attacker can execute arbitrary Python code with the privileges of the subprocess.

The impact includes complete compromise of confidentiality, integrity, and availability of the system running PraisonAI, as indicated by the CVSS score of 9.9 with high impact on confidentiality, integrity, and availability.

• Execution of arbitrary code beyond intended restrictions.
• Potential unauthorized access to sensitive data.
• Possible disruption or damage to system operations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade PraisonAI to version 1.5.115 or later, where the issue is fixed.

Useful 0 Not Useful 0