Compliance Impact

This vulnerability allows attackers to execute arbitrary code with the host process's privileges, leading to unauthorized access to sensitive data such as environment variables, API keys, and local files. Such unauthorized access and potential data exfiltration can result in violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over the confidentiality and integrity of sensitive information.

Because the vulnerability enables sandbox escape and arbitrary system command execution, it increases the risk of data breaches and system compromise, which are critical compliance concerns under these standards.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-40158 is a high-severity vulnerability in PraisonAI's AST-based Python sandbox that allows attackers to bypass security restrictions and execute arbitrary code. The sandbox attempts to block dangerous Python attributes like __subclasses__, __globals__, and __bases__ by filtering AST attribute nodes. However, it only inspects ast.Attribute nodes and fails to check ast.Constant nodes, which can contain these dangerous attribute names.

Attackers exploit this by using the built-in method type.__getattribute__ as a trampoline to dynamically access blocked attributes that the filter misses. This enables them to enumerate subclasses, access internal class globals, and ultimately execute arbitrary system commands, escaping the sandbox.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive data such as environment variables, API keys, and local files. Attackers can execute arbitrary system commands, modify or delete files, and potentially gain full control over the affected system.

It is especially dangerous in environments running untrusted code, such as multi-tenant agent platforms, CI/CD pipelines, or shared systems, where it can lead to data exfiltration, lateral movement, and full system compromise.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the PraisonAI version in use is vulnerable (versions ≤ 4.5.117) and if untrusted agent code is being executed within the AST-based Python sandbox that can be bypassed.

Since the vulnerability exploits the sandbox's failure to block dynamic attribute resolution via type.__getattribute__, detection can focus on monitoring for suspicious use of this method or unusual system command executions originating from the PraisonAI process.

• Check the installed PraisonAI version to confirm if it is older than 4.5.128.
• Monitor logs or runtime behavior for calls to type.__getattribute__ or unexpected system commands executed by PraisonAI.
• Use commands like `ps aux | grep praisonai` to identify running PraisonAI processes.
• Inspect the PraisonAI installation version with commands such as `praisonai --version` or checking package metadata.
• If possible, audit or review agent code execution logs for evidence of code injection or use of dynamic attribute access patterns like `type.__getattribute__`.

Useful 0 Not Useful 0

Mitigation Strategies

The primary and immediate mitigation step is to upgrade PraisonAI to version 4.5.128 or later, where this vulnerability is fixed.

Until the upgrade can be applied, restrict execution of untrusted agent code within PraisonAI to trusted users or environments to minimize risk.

Implement monitoring to detect suspicious activity such as unexpected system command executions or use of dynamic attribute resolution methods.

Consider isolating PraisonAI processes in restricted environments or containers to limit potential impact of exploitation.

Useful 0 Not Useful 0