TI-2026-28766 Aliases CVE-2026-39888 GHSA-qf73-2hrx-xprp

PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

HIGH 76CWE-657Published 2026-04-08 · Updated 2026-04-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-693.

Summary

PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which runs user code in a subprocess wrapped with a restricted __builtins__ dict and an AST-based blocklist. The AST blocklist embedded inside the subprocess wrapper (blocked_attrs of python_tools.py) contains only 11 attribute names — a strict subset of the 30+ names blocked in the direct-execution path. The four attributes that form a frame-traversal chain out of the sandbox are all absent from the subprocess list (__traceback__, tb_frame, f_back, and f_builtins). Chaining these attributes through a caught exception exposes the real Python builtins dict of the subprocess wrapper frame, from which exec can be retrieved and called under a non-blocked variable name — bypassing every remaining security layer. This vulnerability is fixed in 1.5.115.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00504 43rd percentileScored 2026-11-07

Fix Fixed praisonaiagents (MervinPraison): 1.5.115praisonaiagents (PyPI): 1.5.115

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MervinPraison	praisonaiagents	before 1.5.115	1.5.115	Patch available	CNA
—	praisonaiagents (PyPI)	before 1.5.115	1.5.115	Patch available	GHSA-qf73-2hrx-xprp

praisonaiagents VendorMervinPraison Affected before 1.5.115 Fixed in 1.5.115 Patch available CNA
praisonaiagents (PyPI) Vendor— Affected before 1.5.115 Fixed in 1.5.115 Patch available GHSA-qf73-2hrx-xprp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:praison:praisonai::::::::	before 1.5.115	Vulnerable	MervinPraison

cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions before 1.5.115 Vulnerable ·MervinPraison

Remediation

Fix · CNA praisonaiagents (MervinPraison) Fixed in 1.5.115
Fix · GHSA-qf73-2hrx-xprp praisonaiagents (PyPI) Fixed in 1.5.115 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-39888
2026-10-03 Alias added: GHSA-qf73-2hrx-xprp

References

Advisory 2

Other 1

https://github.com/MervinPraison/PraisonAI

TI-2026-30083 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI CVSS 3.1CRITICAL 9.8
TI-2026-29070 PraisonAI: Critical RCE via `type: job` workflow YAML CVSS 3.1CRITICAL 9.8
TI-2026-28940 PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API CVSS 3.1CRITICAL 10.0
TI-2026-28768 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading CVSS 3.1CRITICAL 9.8
TI-2026-27159 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() CVSS 3.1CRITICAL 9.8
TI-2026-27158 PraisonAI: Second-Order SQL Injection in `get_all_user_threads` CVSS 3.1CRITICAL 9.8

See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences