EUVD-2026-77541
GHSA-pv2j-rghr-v5r9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.format_map to resolve dotted fields through C-level attribute access that bypasses _safe_getattr. This exposes class, qualified-name, base-class, globals, and object-dictionary attributes to prompt-influenced code when approval is automatically granted, producing a high-impact read primitive without establishing a complete in-process execution chain. This issue is fixed in praisonaiagents 1.6.59.
AnalysisAI
An attribute-read sandbox bypass in the PraisonAI multi-agent framework (pip package praisonaiagents before 1.6.59) lets prompt-influenced Python code reach blocklisted dunder attributes such as __class__, __bases__, __globals__ and __dict__, exposing in-process objects and secrets to the attacker. Exploitation requires the execute_code tool's sandbox mode with approval automatically granted (for example via PRAISONAI_AUTO_APPROVE or the YAML auto-approval path), after which two CPython semantics are chained: runtime string assembly evades the AST blocklist and str.format/str.format_map resolve dotted fields through C-level attribute access that never consults the Python-level _safe_getattr wrapper. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Praisonaiagents
View allSSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated tool invocation and potential remote code execution in PraisonAI Agents (praisonaiagents) before 1.6.59,
Unauthenticated remote code execution in the PraisonAI multi-agent framework lets any network-reachable caller run arbit
Arbitrary command and code execution in PraisonAI's workflow engine (versions <4.5.139) and praisonaiagents (<1.5.140) a
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary she
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call n
Arbitrary Python code execution in PraisonAI ≤4.5.138 occurs when malicious tools.py files are automatically imported fr
Unauthenticated MCP tool invocation in PraisonAI (praisonaiagents 0.6.0–1.6.58 and praisonai 3.10.0–4.6.58) lets a malic
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today