Executive brief
PraisonAI, a platform for building and running AI agents, contains a security flaw in its code execution sandbox. An attacker can bypass security restrictions to run unauthorized commands on the underlying system. This could lead to the theft of sensitive data like API keys, the deletion of files, or full control over the server hosting the AI agents.
Technical details
A sandbox escape vulnerability exists in the `_execute_code_direct` function within `praisonaiagents/tools/python_tools.py`. The implementation uses Abstract Syntax Tree (AST) filtering to block access to dangerous attributes such as `__subclasses__` and `__globals__`, but it only inspects `ast.Attribute` nodes. An attacker can bypass this check by using `type.__getattribute__(obj, 'attribute_name')`, where the attribute name is passed as an `ast.Constant` (string), which the filter ignores. This allows an attacker to traverse the Python object hierarchy to reach the `os` module or other sensitive components and achieve arbitrary code execution. The issue is resolved in version 4.5.128.
Affected products
- MervinPraison PraisonAI < 4.5.128
Timeline
- 2026-04-09: disclosed: Vulnerability published to MervinPraison/PraisonAI repository
- 2026-04-10: advisory: GitHub Advisory GHSA-3c4r-6p77-xwr7 published
- 2026-04-10: patched: Version 4.5.128 released to address the issue