The PraisonAI multi-agent system is vulnerable to arbitrary code execution due to an insufficient AST-based sandbox, posing a critical security risk to host environments.

This vulnerability involves an improper protection mechanism (CWE-693) and code injection (CWE-94) flaw within the Python sandbox. An attacker can bypass AST filtering in the _execute_code_direct function by using dynamic attribute resolution, such as type.getattribute, to access restricted Python attributes and achieve arbitrary code execution.

Successful exploitation allows an attacker to execute arbitrary code on the host system, effectively bypassing the security boundaries intended to contain untrusted agent code. Given the CVSS score of 8.6, this flaw represents a high-severity risk that could lead to full system compromise, unauthorized data access, and potential lateral movement within the infrastructure.

Immediate Action: Update the PraisonAI package to version 4.5.128 or later immediately to incorporate the necessary sandbox security improvements.

Proactive Monitoring: Monitor execution logs for unusual Python attribute access patterns or errors originating from the praisonaiagents/tools/python_tools.py module that might indicate an attempt to probe the sandbox.

Compensating Controls: Ensure that any agent code execution is performed within a hardened container or a secondary, isolated environment with restricted system-level permissions to minimize the impact of a potential sandbox escape.

Public Exploit Available: No — there is no confirmed public weaponized exploit.

The severity of this vulnerability, combined with the presence of a proof-of-concept, necessitates immediate action. Organizations utilizing PraisonAI must prioritize updating to version 4.5.128 to remediate the sandbox bypass. Failure to patch leaves the host environment exposed to potential arbitrary code execution by any untrusted agent code processed by the system.