PraisonAI’s Python sandbox enforces security through AST filtering of attribute access. Prior to version 4.5.128, the filter only examines ast.Attribute nodes, allowing a type.__getattribute__ trampoline to bypass the blacklist. This enables an attacker to inject malicious code via the string '__subclasses__', which is parsed as an ast.Constant and never checked, leading to arbitrary code execution when the sandbox runs untrusted agent code. The weakness maps to CWE‑94 (Code Injection) and CWE‑693 (Improper Control of Generation of Code).

The vulnerability affects the PraisonAI release maintained by MervinPraison, specifically all versions before 4.5.128. Users running any of these affected builds are at risk if they allow untrusted agents to execute code within the platform.

The CVSS score of 8.6 indicates high severity, and while EPSS data is unavailable, the lack of a KEV listing suggests no publicly known widespread exploitation yet. The likely attack vector is the execution of malicious agent code supplied by an adversary, which then bypasses the sandbox and runs arbitrary Python. This could compromise confidentiality, integrity, and availability of the host system if the sandbox is used in a privileged context.