Is CVE-2026-39888 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39888 being exploited in the wild.

How severe is CVE-2026-39888?

Critical severity, with a CVSS score of 9.9, published 8 April 2026.

Which products and versions are affected?

praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.115.

Is there a fix for CVE-2026-39888?

Yes. praisonaiagents (PyPI): upgrade to 1.5.115 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39888 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39888?

Check whether you run MervinPraison PraisonAI Agents, Praisonai or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39888: PraisonAI sandbox escape via frame traversal in execute_code

CVE-2026-39888 · Severity: critical · CVSS 9.9 · Published 2026-04-08

PraisonAI is a framework for managing multi-agent AI systems. A security flaw in its code execution tool allows an attacker or a malicious AI agent to break out of the restricted "sandbox" environment. This could lead to full control over the underlying server, allowing unauthorized access to sensitive files, API keys, and internal networks.

Technologies: MervinPraison PraisonAI Agents, Praisonai, praisonaiagents (PyPI). Vendors: MervinPraison, Praison, PyPI.

Quick answers

Is CVE-2026-39888 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39888 being exploited in the wild.
How severe is CVE-2026-39888?: Critical severity, with a CVSS score of 9.9, published 8 April 2026.
Which products and versions are affected?: praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.115.
Is there a fix for CVE-2026-39888?: Yes. praisonaiagents (PyPI): upgrade to 1.5.115 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39888 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39888?: Check whether you run MervinPraison PraisonAI Agents, Praisonai or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonaiagents (PyPI): upgrade to 1.5.115 or later
```
pip install "praisonaiagents>=1.5.115"
```

Technical details

The vulnerability exists in the `execute_code` function within `praisonaiagents.tools.python_tools`. When running in the default `sandbox_mode="sandbox"`, the system uses an AST-based blocklist to prevent access to dangerous Python attributes. However, the blocklist used in subprocess mode is significantly weaker than the one used in direct mode, omitting critical attributes such as `__traceback__`, `tb_frame`, `f_back`, and `f_builtins`. An attacker can chain these attributes through a caught exception to traverse the call stack, access the real Python builtins dictionary of the wrapper frame, and retrieve the `exec` function. This allows for arbitrary code execution on the host system, bypassing all intended sandbox restrictions. The issue is fixed in version 1.5.115 by synchronizing the blocklists.

Affected products

MervinPraison (PraisonAI) praisonaiagents < 1.5.115

Identifiers

CVE-2026-39888
GHSA-qf73-2hrx-xprp
PYSEC-2026-486

Timeline

2026-04-07: advisory: Vendor advisory published on GitHub
2026-04-08: disclosed: CVE published to NVD

References

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qf73-2hrx-xprp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.