CVE-2026-57120 in praisonaiagents
Summary
by MITRE • 09/14/2026
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.format_map to resolve dotted fields through C-level attribute access that bypasses _safe_getattr. This exposes class, qualified-name, base-class, globals, and object-dictionary attributes to prompt-influenced code when approval is automatically granted, producing a high-impact read primitive without establishing a complete in-process execution chain. This issue is fixed in praisonaiagents 1.6.59.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified within the PraisonAI multi-agent teams system prior to version 1.6.59 represents a critical security flaw rooted in the improper implementation of sandboxing mechanisms for code execution environments. The core issue lies in how the execute_code function handles restricted attributes and string formatting operations, allowing malicious actors or prompt-influenced inputs to bypass intended safety boundaries. Specifically, the vulnerability permits the runtime assembly of blocklisted dunder names, which are special methods and attributes in Python that typically provide access to internal object structures. By enabling these blocked identifiers during execution, the system fails to enforce strict isolation between untrusted user input and sensitive application internals.
Furthermore, the flaw extends to how string formatting functions such as str.format and str.format_map interact with attribute resolution. These functions are capable of resolving dotted fields through C-level attribute access mechanisms that circumvent the _safe_getattr function. The _safe_getattr method is designed to act as a security gatekeeper by validating attribute names against an allowlist or blocking dangerous patterns before allowing access. When this safeguard is bypassed via low-level attribute resolution, it effectively neutralizes one of the primary defenses against information disclosure in sandboxed environments. This technical oversight allows code executed within the agent system to reach into object hierarchies that should remain inaccessible under normal operational constraints.
The operational impact of this vulnerability is significant due to its nature as a high-impact read primitive. Although it does not immediately establish a complete in-process execution chain for arbitrary command execution, it provides attackers with extensive visibility into sensitive internal states. Through this bypass, an adversary can access critical attributes including class definitions, qualified names, base classes, global variables, and object dictionaries. This level of introspection enables detailed reconnaissance of the application environment, potentially revealing configuration details, secret keys stored in globals, or structural information about other objects that could facilitate further exploitation steps such as deserialization attacks or logic manipulation.
From a classification perspective, this vulnerability aligns with CWE-209 which involves the generation of error messages containing sensitive information, and more broadly with CWE-749 regarding exposure to dangerous data structures in sandboxed environments. In terms of offensive security frameworks like MITRE ATT&CK, this behavior corresponds to techniques related to Discovery, specifically System Information Discovery (T1082) or Application Window Discovery depending on the specific context of access. The ability to read internal object attributes without proper authorization constitutes a severe breach of confidentiality principles within the application architecture.
To mitigate this risk, organizations utilizing PraisonAI must ensure they are operating on version 1.6.59 or later where these sandboxing flaws have been addressed. Developers should also review any custom integrations that might replicate similar patterns of unsafe attribute access or string formatting in their own codebases. Implementing stricter allowlists for dunder methods and ensuring that all attribute accesses go through validated safety wrappers can prevent analogous issues in other systems. Regular security audits focusing on sandbox escape vectors are essential to maintain the integrity of multi-agent AI deployments against prompt-injection induced exploitation attempts.