CVE-2026-39888

OVERVIEW CVE-2026-39888 is a critical sandbox escape vulnerability in PraisonAI versions prior to 1.5.115 that affects the execute_code() function in the python_tools module. The vulnerability exists in the subprocess-based code sandbox implementation, which uses a restricted builtins dictionary and an AST-based blocklist to prevent malicious code execution. However, the subprocess blocklist is significantly less comprehensive than the direct-execution path blocklist, missing four critical attributes (\_\_traceback\_\_, tb_frame, f_back, and f_builtins) that form a frame-traversal chain. SEVERITY The vulnerability carries a CVSS v3.1 score of 9.9 CRITICAL with network-based attack vector, low attack complexity, and low privilege requirements. An authenticated attacker can exploit this through frame traversal by chaining the missing attributes through a caught exception to expose the real Python builtins dictionary of the subprocess wrapper frame. Once accessed, the attacker can retrieve and execute the exec function under non-blocked variable names, completely bypassing all remaining security layers. The impact includes high confidentiality, integrity, and availability compromise with scope change, potentially affecting the entire system. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on the Hot List. The EPSS score of 0.00099 indicates this is currently a lower priority threat compared to other vulnerabilities in the ecosystem. However, given the critical severity and straightforward exploitation mechanism involving standard Python frame attributes, organizations using affected PraisonAI versions should prioritize upgrading to version 1.5.115 or later.