CVE-2026-57120: PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, executecode sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.formatmap to resolve dotted fields through C-level attribute access that bypasses safegetattr. This exposes class, qualified-name, base-class, globals, and object-dictionary attributes to prompt-influenced code when approval is automatically granted, producing a high-impact read primitive without establishing a complete in-process execution chain. This issue is fixed in praisonaiagents 1.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaiagentsto a version that resolves this vulnerability.Fixed in 1.6.59
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using praisonaiagents versions earlier than 1.6.59 are affected when execute_code sandbox mode is used and approval is automatically granted. The exposed data includes class, qualified-name, base-class, globals, and object-dictionary attributes available to prompt-influenced code.
What access does an attacker need?
An attacker needs the ability to influence code evaluated through execute_code sandbox mode. No user interaction is required, but exploitation depends on automatic approval being enabled; the vulnerability description does not establish a complete in-process code-execution chain.
What can be done if upgrading is not immediately possible?
Avoid automatically granting approval for execute_code sandbox requests, particularly for code influenced by prompts or untrusted input. This removes the stated condition under which the read primitive is exposed.
How can this be remediated?
Upgrade praisonaiagents to version 1.6.59, which fixes the issue.