EUVD-2026-21510
GHSA-3c4r-6p77-xwr7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Python code with type.__getattribute__
-
DeliverySubmit code to PraisonAI agent execution
-
ExploitBypass AST attribute filter
-
ExecutionAccess forbidden __subclasses__
-
ImpactExecute arbitrary code with user privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local attacker or untrusted agent code execution within PraisonAI versions prior to 4.5.128. Requires user interaction to execute malicious agent code that bypasses AST sandbox filtering via type.__getattribute__ trampoline. Affects _execute_code_direct function in praisonaiagents/tools/python_tools.py. |
| Impact | CVSS 8.6 reflects high severity with unauthenticated local access and UI interaction required. EPSS and KEV status unknown; exploitation depends on deployment context. Critical for environments running untrusted agent code via PraisonAI's Python sandbox. AST bypass via type.__getattribute__ is straightforward once understood, making patch adoption urgent for affected systems. |
| Exploit ScenarioDerived | Attacker provides malicious agent code containing type.__getattribute__('__subclasses__') to bypass AST filtering. Python sandbox executes string constant without attribute-node validation, allowing access to restricted dunder methods and arbitrary code execution. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Arbitrary code execution in PraisonAI multi-agent system (<4.5.128) via Python sandbox escape. Incomplete AST attribute filtering allows type.__getattribute__ trampoline to bypass restrictions on __subclasses__, __globals__, and __bases__, enabling untrusted agent code to break containment. Attack requires local access and user interaction to execute malicious code. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to PraisonAI version 4.5.128 or later, which addresses the AST filtering bypass. Immediate action: users running multi-agent systems with untrusted code execution must upgrade to eliminate sandbox escape risk. Workaround: restrict execution of untrusted agent code in production environments, enforce strict code review, and isolate agent runtime in containerized sandboxes with restricted syscall policies until patching is complete. Advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-3c4r-6p77-xwr7
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AST-based sandbox in _execute_code_direct function only validates ast.Attribute nodes against blocklist, missing ast.Constant string literals. Attackers invoke type.__getattribute__('__subclasses__') where '__subclasses__' parses as Constant, evading detection and accessing Python introspection primitives for arbitrary code execution via CWE-94 code injection.
Know when Praisonai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI's AST-based Python sandbox can be bypassed using type.__getattribute__ trampoline, allowing arbitrary code execution when running untrusted agent code. The _execute_code_direct function in praisonaiagents/tools/python_tools.py uses AST filtering to block dangerous Python attributes like __subclasses__, __globals__, and __bases__. However, the filter only checks ast.Attribute nodes, allowing a bypass. The sandbox relies on AST-based filtering of attribute access but fails to account for dynamic attribute resolution via built-in methods such as type.getattribute, resulting in incomplete enforcement of security restrictions. The string '__subclasses__' is an ast.Constant, not an ast.Attribute, so it is never checked against the blocked list. This vulnerability is fixed in 4.5.128.
Executive ViewAI
PraisonAI versions prior to 4.5.128 contain a sandbox escape vulnerability (CVSS 8.6) that allows local users to execute arbitrary code by exploiting incomplete Python AST filtering in the multi-agent system. Organizations deploying PraisonAI for autonomous agent workflows face immediate risk of code execution within their AI infrastructure if untrusted agents or prompts are processed.
Until upgrade to version 4.5.128 is completed: (1) Restrict PraisonAI access to authorized personnel only and disable remote access where possible; (2) Run PraisonAI agents in isolated containers with minimal privilege and network access; (3) Implement strict input validation and prevent execution of agents from external or untrusted sources; (4) Monitor process execution and network traffic from PraisonAI systems for anomalous behavior; (5) Disable or remove PraisonAI instances not actively required for operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in PraisonAI Multiple Code Execution and Path Traversal
View all 5Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
System prompt extraction and unauthorized tool invocation in PraisonAI before 4.6.78 arise because the prompt-injection
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Server-side request forgery in PraisonAI's Crawl4AI/Chromium crawling backend (all versions before 1.6.78) lets low-priv
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Exploit-DB