# CVE-2026-39888: PraisonAI sandbox escape via frame traversal in execute_code

Source: https://junglewise.ai/threats/cve-2026-39888-praisonai-sandbox-escape-via-frame-traversal-in-execute-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39888 · Severity: critical · CVSS 9.9 · Published 2026-04-08

PraisonAI is a framework for managing multi-agent AI systems. A security flaw in its code execution tool allows an attacker or a malicious AI agent to break out of the restricted "sandbox" environment. This could lead to full control over the underlying server, allowing unauthorized access to sensitive files, API keys, and internal networks.

Technologies: [MervinPraison PraisonAI Agents](https://junglewise.ai/threats/technologies/praisonai-agents), [Praisonai](https://junglewise.ai/threats/technologies/praisonai), [praisonaiagents (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonaiagents). Vendors: [MervinPraison](https://junglewise.ai/threats/vendors/mervinpraison), [Praison](https://junglewise.ai/threats/vendors/praison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-39888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39888 being exploited in the wild.

**How severe is CVE-2026-39888?** Critical severity, with a CVSS score of 9.9, published 8 April 2026.

**Which products and versions are affected?** praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.115.

**Is there a fix for CVE-2026-39888?** Yes. praisonaiagents (PyPI): upgrade to 1.5.115 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39888 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39888?** Check whether you run MervinPraison PraisonAI Agents, Praisonai or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonaiagents (PyPI): upgrade to 1.5.115 or later

  ```sh
  pip install "praisonaiagents>=1.5.115"
  ```


## Technical details

The vulnerability exists in the `execute_code` function within `praisonaiagents.tools.python_tools`. When running in the default `sandbox_mode="sandbox"`, the system uses an AST-based blocklist to prevent access to dangerous Python attributes. However, the blocklist used in subprocess mode is significantly weaker than the one used in direct mode, omitting critical attributes such as `__traceback__`, `tb_frame`, `f_back`, and `f_builtins`. An attacker can chain these attributes through a caught exception to traverse the call stack, access the real Python builtins dictionary of the wrapper frame, and retrieve the `exec` function. This allows for arbitrary code execution on the host system, bypassing all intended sandbox restrictions. The issue is fixed in version 1.5.115 by synchronizing the blocklists.

## Affected products

- MervinPraison (PraisonAI) praisonaiagents < 1.5.115

## Identifiers

- CVE-2026-39888
- GHSA-qf73-2hrx-xprp
- PYSEC-2026-486

## Timeline

- 2026-04-07: advisory: Vendor advisory published on GitHub
- 2026-04-08: disclosed: CVE published to NVD

## References

- [https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qf73-2hrx-xprp](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qf73-2hrx-xprp)

## Related threats

- [PraisonAI HTTPApproval dashboard XSS and auto-approval](https://junglewise.ai/threats/cve-2026-56840-praisonai-httpapproval-dashboard-renders-tool-arguments-as-raw)
- [PraisonAI SearxNG URL validation bypass in search tools](https://junglewise.ai/threats/cve-2026-57143-praisonai-server-side-request-forgery-ssrf-in-searxng-search-web)
- [PraisonAI missing access control in API endpoints](https://junglewise.ai/threats/cve-2026-57118-praisonai-agentteam-launch-exposes-unauthenticated-remote-agent)
- [PraisonAI legacy SSE endpoint CORS and authentication bypass](https://junglewise.ai/threats/cve-2026-57112-praisonai-legacy-sse-endpoint-cors-and-authentication-bypass)
- [PraisonAI IMAP injection in email tools](https://junglewise.ai/threats/cve-2026-57130-praisonai-imap-injection-in-email-tools)