Description

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime assembly of blocklisted dunder names and allows str.format or str.format_map to resolve dotted fields through C-level attribute access that bypasses _safe_getattr. This exposes class, qualified-name, base-class, globals, and object-dictionary attributes to prompt-influenced code when approval is automatically granted, producing a high-impact read primitive without establishing a complete in-process execution chain. This issue is fixed in praisonaiagents 1.6.59.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T15:17:05.607Z",
  "pubdate": "2026-09-14T15:17:05.607Z",
  "executiveSummary": "The vulnerability in praisonaiagents versions prior to 1.6.59 involves an insecure implementation of the execute_code sandbox mode.\nThe flaw allows for the bypass of security controls intended to restrict sensitive attribute access within the sandbox environment.\nBy leveraging runtime assembly of blocklisted dunder names and exploiting how str.format and str.format_map resolve dotted fields, an attacker can access restricted object attributes.\nThis vulnerability exposes critical system internals, including class references, qualified names, base classes, globals, and the object dictionary.\nThe primary impact is a high-impact read primitive, which allows an attacker to exfiltrate sensitive memory and metadata from the application context.\nThe exploit is particularly dangerous when automatic approval for code execution is enabled, as it allows prompt-influenced code to perform unauthorized introspection without triggering security exceptions.\nThe risk is significant as it undermines the integrity and confidentiality of the multi-agent system's execution environment, potentially serving as a precursor to more severe attacks, such as remote code execution or data exfiltration.",
  "technicalDetails": "The root cause of the vulnerability lies in an insufficient implementation of _safe_getattr within the sandbox environment of praisonaiagents.\nWhile the system maintains a blocklist of dunder (double underscore) methods and attributes to prevent malicious introspection, the mechanism fails to adequately filter attribute resolution during complex string formatting operations.\nSpecifically, the use of str.format and str.format_map permits the resolution of dotted fields through C-level attribute access. Because these methods resolve nested attributes at the C level, they bypass the Python-level checks implemented in _safe_getattr.\nAn attacker can exploit this by crafting a malicious payload that assembles blocked dunder names at runtime. By combining string manipulation techniques with the field resolution capabilities of str.format, an attacker can traverse the object graph.\nThe attack flow begins when the multi-agent system receives an external prompt containing the crafted payload. If the system is configured to grant automatic approval for execute_code tasks, the payload is executed within the sandbox.\nThe payload utilizes dotted notation (e.g., '{obj.__class__.__init__.__globals__}') within a format string. The interpreter resolves these fields directly via C-level attribute access, successfully retrieving the content of restricted attributes despite the presence of the blocklist.\nBecause _safe_getattr is bypassed during this resolution process, the sandbox protection fails to detect or block the access to sensitive internal structures such as __class__, __base__, __globals__, and __dict__.\nThe exposure of __globals__ and the object dictionary provides an attacker with a high-impact read primitive, allowing the inspection of global variables, imported modules, and internal object state.\nThis level of introspection is sufficient to map the internal application logic, steal sensitive keys or tokens stored in global memory, and identify further targets for exploitation. While the vulnerability does not inherently provide a complete in-process execution chain, it grants an attacker significant capability to bypass sandbox restrictions and compromise the integrity of the agentic workflow."
}