Executive brief
PraisonAI is a system used to manage teams of AI agents. A security flaw in its code execution tool allows an attacker to bypass safety restrictions and run unauthorized commands on the underlying server. This could lead to the theft of sensitive data, exposure of API keys, or full control over the host system by anyone who can influence the AI's input.
Technical details
A sandbox escape exists in `praisonaiagents/tools/python_tools.py` within the `execute_code()` function's subprocess sandbox mode. The vulnerability stems from multiple gaps in AST-based validation: the `__self__` attribute is not blocked, allowing access to the `builtins` module via `print.__self__`; the `vars()` function is not restricted; and the dangerous-call check only inspects `ast.Name` nodes, missing `ast.Attribute` or `ast.Subscript` calls. By combining these gaps with runtime string construction to bypass literal checks, an attacker can retrieve `__import__` and execute arbitrary OS commands. This bypass is notable for surviving previous patches related to frame traversal and string subclassing. A fix is available in PraisonAI 4.6.40 and praisonaiagents 1.6.40.
Affected products
- MervinPraison PraisonAI < 4.6.40
- MervinPraison praisonaiagents < 1.6.40
Timeline
- 2026-05-19: patched: Fix merged in PR #1684
- 2026-07-21: disclosed: CVE-2026-47392 published