PraisonAIAgents includes a sandbox escape flaw in its execute_code method when operating in subprocess mode. The method runs user code in a restricted subprocess with a limited __builtins__ dictionary and an abstract syntax tree blocklist. In the vulnerability, four attribute names that enable frame traversal are omitted from the subprocess blocklist. By chaining these attributes through a caught exception, a malicious caller can surface the real Python builtins dictionary of the wrapper frame, retrieve the exec function under an unblocked name, and thereby execute arbitrary code, bypassing all remaining security controls. The weakness is classified as CWE‑657 and CWE‑693.

MervinPraison’s PraisonAI agents, version 1.5.115 and earlier, are affected. No other vendors or product versions are listed in the advisory.

The base CVSS score is 10, indicating maximum severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can supply code to execute_code—such as through an exposed API, plugin interface, or other code payload mechanism—can trigger the exception chain without requiring elevated system privileges. This makes exploitation relatively straightforward for any user with access to the vulnerable function.