CVE-2026-39888
Praisonai ≤ 1.5.115
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-39888 is a critical-severity Violation of Secure Design Principles (CWE-657) vulnerability in Praison Praisonai. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-39888 is a sandbox escape vulnerability in PraisonAI, a multi-agent teams system. In versions prior to 1.5.115, the execute_code() function in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which executes user code in a subprocess with a restricted __builtins__ dictionary and an AST-based blocklist. The blocklist in the subprocess wrapper (blocked_attrs in python_tools.py) only includes 11 attribute names, a subset of those blocked in direct execution, notably omitting __traceback__, tb_frame, f_back, and f_builtins. This allows chaining these attributes via a caught exception to access the real Python builtins dictionary of the wrapper frame, enabling retrieval and execution of exec under a non-blocked name and bypassing all security layers.
An attacker with low privileges (PR:L) can exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), achieving high scope (S:C) and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), as scored at CVSS 9.9 (CVSS:3.1). Exploitation involves crafting Python code that triggers the frame-traversal chain through an exception, exposing unrestricted builtins and allowing arbitrary code execution within the subprocess context.
The vulnerability, tied to CWE-657 (Violation of Secure Design Principles) and CWE-693 (Protection Mechanism Failure), is fixed in PraisonAI version 1.5.115. The GitHub Security Advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qf73-2hrx-xprp provides further details on the patch, which addresses the incomplete blocklist in the subprocess sandbox.
PraisonAI's role as a multi-agent AI system underscores the relevance of this issue to AI/ML deployments relying on code execution sandboxes for agent tools. No real-world exploitation has been reported as of the CVE publication on 2026-04-08.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20635
Vulnerability Data
PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which runs user code in a subprocess wrapped with a restricted __builtins__ dict and an AST-based blocklist. The AST blocklist embedded inside the subprocess wrapper…
more
(blocked_attrs of python_tools.py) contains only 11 attribute names — a strict subset of the 30+ names blocked in the direct-execution path. The four attributes that form a frame-traversal chain out of the sandbox are all absent from the subprocess list (__traceback__, tb_frame, f_back, and f_builtins). Chaining these attributes through a caught exception exposes the real Python builtins dict of the subprocess wrapper frame, from which exec can be retrieved and called under a non-blocked variable name — bypassing every remaining security layer. This vulnerability is fixed in 1.5.115.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 12 hardening rules · 6 OS baselines
V6.3.3V6.6.3V10.2.2
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of access authorizations via the protection mechanism itself.
AC-4 mandates use of information flow enforcement mechanisms to control data movement.
Explicitly requires application of security and privacy engineering principles throughout the lifecycle, structurally preventing their violation.
SC-2 requires separation of user and system functionality as a protection mechanism.
SC-28 requires protection mechanisms for information at rest.
SC-3 requires isolation of security functions from non-security functions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Establishes risk-management policy that can embed secure design expectations at the organizational level.
Enforcing authentication directly implements a core protection mechanism whose absence or misuse is the CWE.
Explicitly requires incorporating least privilege, one key secure design principle.
Cryptographic and integrity controls are protection mechanisms whose correct deployment mitigates the CWE.
Encryption and integrity protections for transit are explicit protection mechanisms.
Logical network protections are protection mechanisms whose failure matches the CWE.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Systematic verification that security mechanisms operate according to defined standards reduces the likelihood that protection mechanisms are bypassed or disabled.
Embedding security in project management helps enforce secure design principles from the outset.
Hardening devices, disabling vulnerable protocols, and maintaining accurate network diagrams reduce the likelihood that a protection mechanism is misconfigured or left in a weak state.
A secure development life cycle directly requires adherence to established secure design principles.
Secure system architecture and engineering principles are the explicit embodiment of the secure design principles violated by CWE-657.
Secure coding practices help realize secure design principles at implementation time.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-693
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. prevents CWE-693
Ubuntu 22.04 (1 rule)
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-657
Ubuntu 24.04 (1 rule)
- V-270748 Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-657
Windows 10 (2 rules)
- V-220865 The Windows Remote Management (WinRM) service must not use Basic authentication. prevents CWE-693
- V-220812 Credential Guard must be running on Windows 10 domain-joined systems. prevents CWE-693
Windows Server 2016 (3 rules)
- V-225012 Windows Server 2016 must be running Credential Guard on domain-joined member servers. prevents CWE-693
- V-224992 Domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
- V-224993 PKI certificates associated with user accounts must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
Windows Server 2019 (3 rules)
- V-205907 Windows Server 2019 must be running Credential Guard on domain-joined member servers. prevents CWE-693
- V-205646 Windows Server 2019 domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
- V-205647 Windows Server 2019 PKI certificates associated with user accounts must be issued by a DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657