External risk intelligence

PraisonAI Code Execution Sandbox Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-39888

PraisonAI is a framework for multi-agent systems. While these tools can be integrated into internet-facing applications or APIs, they are often used as backend components, internal automation scripts, or developer-focused libraries. The vulnerability exists within code execution logic, which may or may not be exposed to external inputs depending on the specific deployment architecture.

Praisonai

before 1.5.115

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in PraisonAI, a system for multi-agent teams, that could allow an attacker with limited access to execute arbitrary code, potentially leading to a significant compromise of the system. The issue stems from how user code is executed within the system, where a flaw in the security controls can be bypassed. The main concern is confirming the relevance and exposure of this technology within our environment, as the system's typical use cases can vary from internal tools to internet-facing applications.

Flaw allows unauthorized code execution.
Understand if PraisonAI is in use.
Assess potential impact and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by interacting with a PraisonAI system that has not been updated to the latest version. By crafting a specific input, an attacker can manipulate the code execution environment to bypass security restrictions. This bypass allows the attacker to execute arbitrary code, potentially leading to a complete compromise of the system.

Requires authenticated access.
Triggered by crafted code execution input.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When PraisonAI is used in its default configuration, user-provided code can be executed with elevated privileges due to a flaw in the sandbox environment. This bypass allows for the retrieval and execution of arbitrary commands, potentially impacting the integrity and confidentiality of the system running the PraisonAI multi-agent teams system.

System commands and sensitive data.
Bypassing sandbox restrictions via exception chaining.
Full system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for the PraisonAI platform or any applications integrating its code execution capabilities are likely to address this vulnerability. The first practical step is to identify all deployments of PraisonAI, determine if the affected functionality is exposed or critical, and locate the accountable technical owner to plan remediation.

Platform or application owners should own.
Verify code execution reachability and criticality.
Plan coordinated remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI and how is it used?

PraisonAI is a framework designed to build and manage multi-agent systems, which are groups of autonomous software agents that collaborate to complete complex tasks. Users leverage it to automate workflows or integrate AI-driven intelligence into backend components and developer tools. Because it handles various automation logic, it is frequently deployed within internal environments or as part of larger, interconnected software architectures.

What is the vulnerability in CVE-2026-39888?

This CVE involves a sandbox escape, classified as CWE-693 (Protection Mechanism Failure). The system attempts to restrict user-provided code using a blocklist of forbidden Python attributes. However, the list is incomplete, allowing an attacker to use a technique called exception chaining to traverse through protected object frames. This effectively breaks the isolation, letting the code access restricted Python built-ins to execute unauthorized commands on the underlying system.

How can an attacker trigger this sandbox bypass?

An attacker triggers the vulnerability by submitting crafted code for execution within the PraisonAI environment. The exploit succeeds because the restricted subprocess wrapper fails to block specific frame-traversal attributes. Simply providing standard, benign instructions will not trigger this; the exploit requires specific inputs designed to chain exceptions and manipulate the runtime environment to gain elevated code execution privileges.

Is my PraisonAI deployment at risk?

According to Halo Surface Signal, risk depends on your deployment architecture. If your PraisonAI instance is integrated into an internet-facing API or an application that accepts untrusted input for execution, the risk is higher. If the framework is used solely for restricted, internal automation scripts where users cannot supply arbitrary code, the attack surface is significantly reduced.

How do I secure my system against this flaw?

The most effective way to secure your environment is to update the PraisonAI framework to version 1.5.115 or higher. If you cannot update immediately, identify all instances of the software within your infrastructure and assess whether they are reachable by external inputs. Coordinate with the technical owners of those services to prioritize patching and ensure that untrusted user input is not permitted to reach the vulnerable code execution function.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qf73…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.