PraisonAI’s SandlockSandbox normally relies on the Landlock kernel feature to enforce filesystem and network restrictions on untrusted code. When the Landlock module is missing or reports that it is unavailable, the sandbox’s execute() method falls back silently to a SubprocessSandbox that does not apply the native policy. As a result, code that is intended to run in a restricted environment can read files outside the allowed path and open network connections even when the sandbox configuration specifies network access is disabled. This flaw allows an attacker to gain unauthorized read and network capabilities from within sandboxed code, creating a path to data exfiltration, lateral movement, or command‑and‑control communication. The weakness is consistent with Improper Authorization (CWE‑266), Improper Access Control (CWE‑668), and Failure to Validate Permissions (CWE‑693).

The vulnerability applies to PraisonAI versions from 4.5.110 through 4.6.60 inclusive. Any deployment that uses the SandlockSandbox on a system that lacks supported Landlock support is vulnerable, regardless of operating system vendor.

With a CVSS score of 8.8 the issue is classified as high severity. EPSS data is not available, so the current exploitation likelihood is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The most probable attack vector involves an attacker injecting or directing untrusted code to run under the SandlockSandbox interface on a kernel without Landlock, thereby exploiting the silent fallback. The resulting privilege escalation can expose internal files and enable outbound communication from within the sandbox, providing an attacker with significant data theft or remote control opportunities.