CVE-2026-60085: PraisonAI sandbox policy no-op

CISO Take

PraisonAI's default Subprocess Sandbox silently ignores every security control an operator configures — blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write are all no-ops — so any agent or user that can reach a PraisonAI-backed tool invocation gets unrestricted shell execution and filesystem read access regardless of the policy set on paper. This is network-exploitable (AV:N), requires no privileges or user interaction, and lands at CVSS 7.5 high, defeating the exact guardrail teams deploy the sandbox to enforce — a false sense of containment is worse than none. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, and our data shows only 1 tracked downstream dependent, so today's exposure looks contained; but the CVSS impact subscores (C:H/I:N/A:N) understate real risk given the advisory explicitly describes destructive operations enabled by the bypass. Upgrade to PraisonAI 4.6.78 or later immediately; until patched, treat blocked_commands/blocked_paths/blocked_imports/allow_subprocess/allow_file_write as non-functional and enforce isolation at the OS/container layer instead (dropped capabilities, seccomp, no host filesystem mounts), and alert on unexpected subprocess spawns or file access outside the agent's declared working directory.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High severity, low complexity to exploit once an attacker can reach the sandboxed tool invocation path — the vulnerability is not a bypass technique but a complete absence of enforcement, so no crafted payload or special skill is needed beyond normal agent/tool interaction. No active exploitation signals (not in CISA KEV, no EPSS score, no public PoC or Nuclei template), which lowers near-term opportunistic risk, but the trivial exploitability and network attack vector mean risk rises sharply if PraisonAI-based agents are exposed to untrusted input (public-facing chat interfaces, multi-tenant agent platforms, or any agent that processes external/untrusted data). The package's history of 138 other CVEs and an OpenSSF/package risk score of 0/100 in our data suggest a broader pattern of insufficient security hardening in this project, warranting extra scrutiny of any other PraisonAI-enforced controls.

How does the attack unfold?

Initial Access

Adversary reaches a PraisonAI agent exposed over the network and induces or directly issues a subprocess tool invocation (e.g., via prompt injection or direct API access).

AML.T0053

Sandbox Bypass

The Subprocess Sandbox's blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write policies are silently ignored, so no restriction is enforced.

AML.T0097

Execution & Collection

Attacker runs arbitrary shell commands and reads sensitive files (credentials, configs) that the policy was supposed to block.

AML.T0037

Impact

Attacker performs destructive file operations or pivots the host compromise into broader network/data access, despite configuration explicitly disallowing write/subprocess access.

AML.T0101

Initial Access

Adversary reaches a PraisonAI agent exposed over the network and induces or directly issues a subprocess tool invocation (e.g., via prompt injection or direct API access).

AML.T0053

Sandbox Bypass

The Subprocess Sandbox's blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write policies are silently ignored, so no restriction is enforced.

AML.T0097

Execution & Collection

Attacker runs arbitrary shell commands and reads sensitive files (credentials, configs) that the policy was supposed to block.

AML.T0037

Impact

Attacker performs destructive file operations or pivots the host compromise into broader network/data access, despite configuration explicitly disallowing write/subprocess access.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Patch to PraisonAI 4.6.78 or later immediately. Until patched, do not treat the Subprocess Sandbox's blocked_commands, blocked_paths, blocked_imports, allow_subprocess, or allow_file_write settings as a security boundary — assume any agent using this sandbox has unrestricted subprocess and file access. Compensate with OS/container-level isolation: run agents in minimal-privilege containers with dropped Linux capabilities, seccomp/AppArmor profiles, read-only root filesystems, and no mounts to sensitive host paths. Restrict network egress from agent hosts to limit exfiltration if a bypass is exploited. For detection, monitor for subprocess execution or file access from agent processes that falls outside expected command/path allowlists, and review logs for unexpected shell invocations or reads of sensitive files (credentials, config, SSH keys) originating from PraisonAI-managed processes.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Data Leakage Agent Framework AML.T0037 - Data from Local System AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0097 - Virtualization/Sandbox Evasion AML.T0101 - Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security controls

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-60085?

PraisonAI's default Subprocess Sandbox silently ignores every security control an operator configures — blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write are all no-ops — so any agent or user that can reach a PraisonAI-backed tool invocation gets unrestricted shell execution and filesystem read access regardless of the policy set on paper. This is network-exploitable (AV:N), requires no privileges or user interaction, and lands at CVSS 7.5 high, defeating the exact guardrail teams deploy the sandbox to enforce — a false sense of containment is worse than none. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, and our data shows only 1 tracked downstream dependent, so today's exposure looks contained; but the CVSS impact subscores (C:H/I:N/A:N) understate real risk given the advisory explicitly describes destructive operations enabled by the bypass. Upgrade to PraisonAI 4.6.78 or later immediately; until patched, treat blocked_commands/blocked_paths/blocked_imports/allow_subprocess/allow_file_write as non-functional and enforce isolation at the OS/container layer instead (dropped capabilities, seccomp, no host filesystem mounts), and alert on unexpected subprocess spawns or file access outside the agent's declared working directory.

Is CVE-2026-60085 actively exploited?

No confirmed active exploitation of CVE-2026-60085 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-60085?

Patch to PraisonAI 4.6.78 or later immediately. Until patched, do not treat the Subprocess Sandbox's blocked_commands, blocked_paths, blocked_imports, allow_subprocess, or allow_file_write settings as a security boundary — assume any agent using this sandbox has unrestricted subprocess and file access. Compensate with OS/container-level isolation: run agents in minimal-privilege containers with dropped Linux capabilities, seccomp/AppArmor profiles, read-only root filesystems, and no mounts to sensitive host paths. Restrict network egress from agent hosts to limit exfiltration if a bypass is exploited. For detection, monitor for subprocess execution or file access from agent processes that falls outside expected command/path allowlists, and review logs for unexpected shell invocations or reads of sensitive files (credentials, config, SSH keys) originating from PraisonAI-managed processes.

What systems are affected by CVE-2026-60085?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, tool-calling / function-calling pipelines, multi-agent orchestration.

What is the CVSS score for CVE-2026-60085?

CVE-2026-60085 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

agent frameworkstool-calling / function-calling pipelinesmulti-agent orchestration

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0097 Virtualization/Sandbox Evasion

AML.T0101 Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.

Exploitation Scenario

An organization deploys a PraisonAI-based customer support agent with a Subprocess Sandbox configured to block dangerous commands and restrict file access to a scratch directory, believing this constrains what the agent can do even if manipulated. An attacker submits a crafted input (e.g., via prompt injection embedded in a support ticket or document the agent processes) that causes the agent to invoke its subprocess tool with a command like reading /etc/passwd, exfiltrating environment variables containing API keys, or spawning a reverse shell. Because the sandbox's enforcement logic is a no-op, none of the configured blocklists trigger, and the command executes with the full privileges of the agent process — turning what should have been a contained, low-risk tool call into full command execution and sensitive data exposure on the host.

Weaknesses (CWE)

CWE-273 Improper Check for Dropped Privileges CWE-273 Improper Check for Dropped Privileges

CWE-273 — Improper Check for Dropped Privileges: The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
[Implementation] Check the results of all functions that return a value and verify that the value is expected.

Source: MITRE CWE corpus.