AI Threat AlertCVE-2026-57120: PraisonAI: sandbox bypass leaks agent internals
MEDIUMCISA: TRACK*A flaw in PraisonAI's multi-agent execute_code sandbox lets prompt-influenced code bypass the framework's attribute blocklist by routing through str.format/str.format_map, which resolve dotted attribute chains via C-level access that the _safe_getattr filter never inspects. This gives an attacker a read primitive into class hierarchies, base classes, qualified names, and object/global dictionaries — potentially exposing secrets, config, or internal state held in the agent process, though it stops short of a full remote code execution chain. There's no CISA KEV listing, no EPSS score, and no public exploit or scanner template, so this isn't under active exploitation; the practical risk hinges entirely on whether your deployment runs execute_code with automatic approval on a network-reachable agent. Patch to praisonaiagents 1.6.59 or later, and in the interim require human approval for any code-execution tool invocation rather than auto-granting it. If you can't patch immediately, audit agent logs for format-string payloads referencing __class__, __globals__, or __dict__ as a detection signal.
What is the risk?
Medium risk (CVSS 6.5, confidentiality-only impact — C:H/I:N/A:N). Network-exploitable with low complexity, low privileges, and no user interaction, but the practical blast radius is bounded: the flaw yields an information-disclosure read primitive (class/globals/dict introspection), not a complete in-process execution chain. Exploitability in the wild is currently theoretical — no EPSS score, no CISA KEV entry, no public PoC or Nuclei template exists. Real-world exposure depends heavily on deployment configuration: the sandbox must be reachable via prompt-influenced input AND execute_code approval must be set to automatic (no human-in-the-loop gate) for the read primitive to be attacker-triggerable.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI Agents | pip | — | No patch |
Do you use PraisonAI Agents? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade praisonaiagents to >=1.6.59, which fixes the format-string attribute bypass. 2) Until patched, disable automatic approval for the execute_code tool — require explicit human confirmation before sandboxed code runs, especially on agents reachable from untrusted/network input. 3) Where automation must stay on, restrict execute_code availability to internal, non-network-facing agents only. 4) Add detection for format-string patterns referencing __class__, __globals__, __init__, __subclasses__, or __dict__ in agent-generated code or execution logs. 5) Rotate any secrets that were reachable in-process (env vars, config objects) if exposure is suspected, since this bug specifically targets object/global-dict disclosure.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-57120?
A flaw in PraisonAI's multi-agent execute_code sandbox lets prompt-influenced code bypass the framework's attribute blocklist by routing through str.format/str.format_map, which resolve dotted attribute chains via C-level access that the _safe_getattr filter never inspects. This gives an attacker a read primitive into class hierarchies, base classes, qualified names, and object/global dictionaries — potentially exposing secrets, config, or internal state held in the agent process, though it stops short of a full remote code execution chain. There's no CISA KEV listing, no EPSS score, and no public exploit or scanner template, so this isn't under active exploitation; the practical risk hinges entirely on whether your deployment runs execute_code with automatic approval on a network-reachable agent. Patch to praisonaiagents 1.6.59 or later, and in the interim require human approval for any code-execution tool invocation rather than auto-granting it. If you can't patch immediately, audit agent logs for format-string payloads referencing __class__, __globals__, or __dict__ as a detection signal.
Is CVE-2026-57120 actively exploited?
No confirmed active exploitation of CVE-2026-57120 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-57120?
1) Upgrade praisonaiagents to >=1.6.59, which fixes the format-string attribute bypass. 2) Until patched, disable automatic approval for the execute_code tool — require explicit human confirmation before sandboxed code runs, especially on agents reachable from untrusted/network input. 3) Where automation must stay on, restrict execute_code availability to internal, non-network-facing agents only. 4) Add detection for format-string patterns referencing __class__, __globals__, __init__, __subclasses__, or __dict__ in agent-generated code or execution logs. 5) Rotate any secrets that were reachable in-process (env vars, config objects) if exposure is suspected, since this bug specifically targets object/global-dict disclosure.
What systems are affected by CVE-2026-57120?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, sandboxed code execution tools.
What is the CVSS score for CVE-2026-57120?
CVE-2026-57120 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.56%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0051LLM Prompt InjectionAML.T0053AI Agent Tool InvocationAML.T0097Virtualization/Sandbox EvasionAML.T0106Exploitation for Credential AccessCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.format_map to resolve dotted fields through C-level attribute access that bypasses _safe_getattr. This exposes class, qualified-name, base-class, globals, and object-dictionary attributes to prompt-influenced code when approval is automatically granted, producing a high-impact read primitive without establishing a complete in-process execution chain. This issue is fixed in praisonaiagents 1.6.59.
Exploitation Scenario
A CISO's organization exposes a PraisonAI-based customer-support agent via a public chat widget, with execute_code configured to auto-approve tool calls for responsiveness. An attacker sends a message that induces the agent to generate Python code containing a crafted str.format call, e.g. something equivalent to '{0.__class__.__init__.__globals__[some_key]}', embedded as a format argument. Because _safe_getattr's blocklist only intercepts direct attribute access and not the C-level resolution str.format performs internally, the payload executes and returns the object's class hierarchy and global namespace contents in the agent's response — leaking API keys or internal configuration values the attacker then uses to pivot into connected systems (e.g. LLM API keys, database credentials cached in memory).
Weaknesses (CWE)
CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3493810.0praisonaiagents: sandbox bypass enables full host RCE
Same package: praisonaiagentsCVE-2026-3988810.0praisonaiagents: sandbox escape enables host RCE
Same package: praisonaiagentsCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiagentsCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonaiagentsGHSA-vc46-vw85-3wvm9.8PraisonAI: RCE via malicious workflow YAML execution
Same package: praisonaiagents