Executive brief
PraisonAI is an AI agent framework that includes a tool for executing Python code within a sandbox. A vulnerability in this sandbox allows an attacker to bypass security restrictions and read sensitive internal data, such as system attributes and global variables, that are normally blocked. This could lead to the exposure of internal application logic or data if the agent is configured to automatically approve code execution.
Technical details
The `execute_code` tool's subprocess sandbox in PraisonAI (specifically the `praisonaiagents` package) is vulnerable to a sandbox bypass. The defense mechanism relies on AST validation and a restricted `__builtins__` environment, but these are bypassed using two CPython behaviors: runtime string assembly to evade static AST checks for blocked 'dunder' names, and C-level attribute access via `str.format` or `str.format_map`. Because `str.format` resolves dotted field references through CPython's internal `PyObject_GetAttr`, it sidesteps the Python-level `_safe_getattr` wrapper. This allows an attacker to read any blocklisted attribute (e.g., `__class__`, `__globals__`, `__dict__`). The vulnerability is reachable if `PRAISONAI_AUTO_APPROVE` is enabled, allowing LLM-generated payloads to execute without human intervention. This has been patched in version 1.6.59.
Affected products
- MervinPraison praisonaiagents < 1.6.59
Timeline
- 2026-06-17: disclosed
- 2026-06-18: advisory
- 1.6.59: patched