CVE-2026-39888 is a critical sandbox bypass (CVSS 9.9) in PraisonAI's execute_code() tool. The subprocess sandbox blocklist names far fewer attributes than the direct path, leaving a route to the real builtins. PraisonAI versions before 1.5.115 are affected, and 1.5.115 fixes it.
What's affected
PraisonAI before 1.5.115 is affected. The fixed version is 1.5.115.
The function lives in praisonaiagents.tools.python_tools and defaults to sandbox_mode set to sandbox. The advisory says the subprocess blocklist holds 11 attribute names against more than 30 on the direct execution path.
How to check if you're exposed
pip show praisonai praisonaiagents
pip freeze | grep -i praisonai
The advisory refers to version 1.5.115. If your environment lists the two packages with different numbers, read the advisory to see which one maps to the fix.
What to do now
- Upgrade to 1.5.115 or later and confirm with pip show.
- Find agents that can reach execute_code() and consider removing the tool where it is not needed.
- Run code execution tools inside a container or VM, not only an in-process sandbox.
- Treat model written code as untrusted input.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
The record lists CWE-657 (Violation of Secure Design Principles) and CWE-693 (Protection Mechanism Failure). Language level sandboxes that rely on blocklists are fragile, because every missing name is a possible way out. The advisory describes a chain through attributes that were absent from the subprocess list, reaching the real builtins of the wrapper.
The safer design is isolation at the operating system level, with the language filter as a second layer. The record does not flag this CVE as exploited in the wild.
Quick check
Is a blocklist sandbox enough?
This CVE shows it is not. Add process, container or VM isolation.
What is the fixed version?
1.5.115.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
