PraisonAI Sandbox Bypasses Enabled Arbitrary Code Execution in Agent Python Tools

Two high-severity vulnerabilities in PraisonAI exposed its Python sandbox protections to bypass, allowing arbitrary code execution when untrusted agent code was run. CVE-2026-39888 affected versions prior to 1.5.115 in praisonaiagents.tools.python_tools.execute_code() when sandbox_mode defaulted to sandbox; the subprocess wrapper relied on a restricted __builtins__ dictionary and an incomplete AST blocklist that omitted frame-traversal attributes including __traceback__, tb_frame, f_back, and f_builtins. By catching an exception and traversing frames, an attacker could recover the real Python builtins from the wrapper frame and invoke exec, defeating the intended sandbox restrictions.

A second flaw, CVE-2026-40158, affected PraisonAI versions prior to 4.5.128 in _execute_code_direct within praisonaiagents/tools/python_tools.py. That sandbox used AST filtering to block dangerous Python attributes, but only inspected ast.Attribute nodes and missed dynamic attribute resolution through built-in mechanisms such as type.__getattribute__. Attackers could therefore reach blocked capabilities such as __subclasses__ through a trampoline technique because the string appeared as an ast.Constant rather than an ast.Attribute, undermining the protection model until the vendor patched the issue in 4.5.128.