CVE-2026-57120
Deferred Deferred - Pending Action

Sandbox Escape via Dunder Attribute Access in PraisonAI

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.format_map to resolve dotted fields through C-level attribute access that bypasses _safe_getattr. This exposes class, qualified-name, base-class, globals, and object-dictionary attributes to prompt-influenced code when approval is automatically granted, producing a high-impact read primitive without establishing a complete in-process execution chain. This issue is fixed in praisonaiagents 1.6.59.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-57120
EUVD
EUVD-2026-77541

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
praisonai praisonaiagents 1.6.59
praisonai praisonaiagents to 1.6.59 (exc)
mervinpraison praisonaiagents to 1.6.53 (exc)
mervinpraison praisonaiagents 1.6.59
mervinpraison praisonaiagents to 1.6.52 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a sandbox bypass in PraisonAI's execute_code tool. It allows attackers to bypass security measures and read blocklisted attributes like class, base-class, and object-dictionary through runtime string assembly and C-level attribute access using str.format or str.format_map. The sandbox's defenses are partially bypassed because dynamically assembled dunder names evade detection and C-level access bypasses Python's _safe_getattr wrapper.

Detection Guidance

To detect this vulnerability, check if your system uses praisonaiagents versions prior to 1.6.59. Inspect installed packages with commands like pip show praisonaiagents or pip list. Verify if the execute_code tool is enabled in sandbox mode and review environment variables like PRAISONAI_AUTO_APPROVE for auto-approval settings.

Impact Analysis

This vulnerability allows attackers to read sensitive attributes and data within the sandboxed environment. While it does not directly enable code execution, it provides a high-impact read primitive that could expose confidential information. The impact is higher if the PRAISONAI_AUTO_APPROVE environment variable is set, as it may bypass approval gates.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. The high confidentiality impact (C:H in CVSS) means it may result in data breaches, triggering compliance obligations for incident reporting and risk mitigation.

Mitigation Strategies
  • Upgrade praisonaiagents to version 1.6.59 or later to address the sandbox bypass vulnerability.
  • Disable the PRAISONAI_AUTO_APPROVE environment variable if set, to prevent automatic approval bypass.
  • Review and restrict access to the execute_code tool, especially in automated workflows.
  • Implement additional sandboxing measures outside the application, as the in-process sandbox may not provide full isolation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57120. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart