MervinPraison praisonaiagents up to 1.5.114 praisonaiagents.tools.python_tools execute_code violation of secure design principles

Summaryinfo

A vulnerability was found in MervinPraison praisonaiagents up to 1.5.114. It has been rated as critical. The affected element is the function execute_code of the file praisonaiagents.tools.python_tools. This manipulation causes violation of secure design principles. This vulnerability is handled as CVE-2026-39888. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in MervinPraison praisonaiagents up to 1.5.114. It has been declared as critical. Affected by this vulnerability is the function execute_code of the file praisonaiagents.tools.python_tools. The manipulation with an unknown input leads to a violation of secure design principles vulnerability. The CWE definition for the vulnerability is CWE-657. The product violates well-established principles for secure design. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which runs user code in a subprocess wrapped with a restricted __builtins__ dict and an AST-based blocklist. The AST blocklist embedded inside the subprocess wrapper (blocked_attrs of python_tools.py) contains only 11 attribute names — a strict subset of the 30+ names blocked in the direct-execution path. The four attributes that form a frame-traversal chain out of the sandbox are all absent from the subprocess list (__traceback__, tb_frame, f_back, and f_builtins). Chaining these attributes through a caught exception exposes the real Python builtins dict of the subprocess wrapper frame, from which exec can be retrieved and called under a non-blocked variable name — bypassing every remaining security layer. This vulnerability is fixed in 1.5.115.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-39888 since 04/07/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available.

Upgrading to version 1.5.115 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• MervinPraison

Name

• praisonaiagents

Version

• 1.5.114

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion