CVE-2026-39888
Undergoing Analysis Undergoing Analysis - In Progress
Sandbox Escape in PraisonAI Python Tools Enables Code Execution

Publication date: 2026-04-08

Last updated on: 2026-04-15

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which runs user code in a subprocess wrapped with a restricted __builtins__ dict and an AST-based blocklist. The AST blocklist embedded inside the subprocess wrapper (blocked_attrs of python_tools.py) contains only 11 attribute names β€” a strict subset of the 30+ names blocked in the direct-execution path. The four attributes that form a frame-traversal chain out of the sandbox are all absent from the subprocess list (__traceback__, tb_frame, f_back, and f_builtins). Chaining these attributes through a caught exception exposes the real Python builtins dict of the subprocess wrapper frame, from which exec can be retrieved and called under a non-blocked variable name β€” bypassing every remaining security layer. This vulnerability is fixed in 1.5.115.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-08
Last Modified
2026-04-15
Generated
2026-05-07
AI Q&A
2026-04-09
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
praison praisonai to 1.5.115 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-657 The product violates well-established principles for secure design.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in PraisonAI, a multi-agent teams system, specifically in the execute_code() function of praisonaiagents.tools.python_tools before version 1.5.115. The function runs user code in a subprocess with a restricted builtins dictionary and an AST-based blocklist to limit dangerous operations. However, the subprocess blocklist only blocks 11 attribute names, missing four critical attributes (__traceback__, tb_frame, f_back, and f_builtins) that allow an attacker to traverse the frame stack.

By chaining these unblocked attributes through a caught exception, an attacker can access the real Python builtins dictionary of the subprocess wrapper frame. From there, they can retrieve and call the exec function under a non-blocked variable name, effectively bypassing all remaining security layers and escaping the sandbox restrictions.

This vulnerability was fixed in version 1.5.115.


How can this vulnerability impact me? :

This vulnerability allows an attacker to escape the sandbox environment intended to restrict user code execution. By bypassing the sandbox, the attacker can execute arbitrary Python code with the privileges of the subprocess.

The impact includes complete compromise of confidentiality, integrity, and availability of the system running PraisonAI, as indicated by the CVSS score of 9.9 with high impact on confidentiality, integrity, and availability.

  • Execution of arbitrary code beyond intended restrictions.
  • Potential unauthorized access to sensitive data.
  • Possible disruption or damage to system operations.

What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, you should upgrade PraisonAI to version 1.5.115 or later, where the issue is fixed.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart