MervinPraison PraisonAI up to 4.5.127 python_tools.py _execute_code_direct code injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in MervinPraison PraisonAI up to 4.5.127. The impacted element is the function _execute_code_direct of the file praisonaiagents/tools/python_tools.py. Performing a manipulation results in code injection. This vulnerability is reported as CVE-2026-40158. The attack requires a local approach. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in MervinPraison PraisonAI up to 4.5.127. It has been classified as critical. This affects the function _execute_code_direct of the file praisonaiagents/tools/python_tools.py. The manipulation with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI's AST-based Python sandbox can be bypassed using type.__getattribute__ trampoline, allowing arbitrary code execution when running untrusted agent code. The _execute_code_direct function in praisonaiagents/tools/python_tools.py uses AST filtering to block dangerous Python attributes like __subclasses__, __globals__, and __bases__. However, the filter only checks ast.Attribute nodes, allowing a bypass. The sandbox relies on AST-based filtering of attribute access but fails to account for dynamic attribute resolution via built-in methods such as type.getattribute, resulting in incomplete enforcement of security restrictions. The string '__subclasses__' is an ast.Constant, not an ast.Attribute, so it is never checked against the blocked list. This vulnerability is fixed in 4.5.128.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-40158 since 04/09/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 4.5.128 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• MervinPraison

Name

• PraisonAI

Version

• 4.5.127

Website

• Product: https://github.com/MervinPraison/PraisonAI/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion