PT-2026-61774 · Pypi · Praisonaiagents
CVE-2026-57120
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
praisonai-agents (affected versions not specified)
Description
The
execute code tool contains a flaw in its subprocess sandbox that allows an arbitrary read primitive over blocklisted attributes. The issue arises from the combination of two CPython behaviors: runtime string assembly and C-level attribute access via format specifications. The AST validator in validate code ast() can be bypassed by assembling blocked names at runtime, as the static check only examines constant nodes. Furthermore, str.format and str.format map resolve dotted field references using internal C-level functions that bypass the safe getattr() wrapper and the SANDBOX BLOCKED ATTRS blocklist. This allows access to sensitive attributes such as class, qualname, bases, base, globals, and dict. The vulnerability is accessible when the PRAISONAI AUTO APPROVE environment variable is set, which bypasses the critical risk approval gate.Recommendations
Add
format and format map to the SANDBOX BLOCKED CALLS list to block these calls at the AST layer.
Replace str in safe builtins with a subclass that rejects dotted fields resolving to attributes starting with an underscore in its format and format map methods.
Restrict the use of the execute code function in sandbox mode if external sandboxing (such as gVisor or containers) is not implemented.Fix
Protection Mechanism Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Praisonaiagents