CVE-2026-57120: PraisonAI Information Disclosure Vulnerability

CVE-2026-57120 Overview

CVE-2026-57120 is a sandbox bypass vulnerability in PraisonAI, a multi-agent teams framework. Versions of praisonaiagents prior to 1.6.59 fail to fully constrain the execute_code sandbox mode. Attackers can assemble blocklisted dunder names at runtime and abuse str.format or str.format_map to resolve dotted fields through C-level attribute access. This access path bypasses the _safe_getattr guard and exposes __class__, __qualname__, __bases__, __globals__, and __dict__ attributes to prompt-influenced code when approval is automatically granted. The flaw is categorized as a protection mechanism failure [CWE-693].

Critical Impact
Prompt-influenced code can read internal Python object attributes, yielding a high-impact information disclosure primitive against agent processes.

Affected Products

PraisonAI praisonaiagents package prior to version 1.6.59
Deployments using execute_code sandbox mode with automatic approval
Multi-agent workflows that pass untrusted prompts to code execution tools

Discovery Timeline

2026-09-14 - CVE-2026-57120 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-57120

Vulnerability Analysis

The execute_code sandbox in PraisonAI relies on _safe_getattr to block sensitive dunder attributes. The guard operates at the Python level and inspects attribute names before granting access. However, str.format and str.format_map perform attribute lookups through the C-level PyObject_GetAttr path, sidestepping the Python-level filter entirely.

An attacker crafts a format string with dotted field references such as {obj.__class__.__bases__} and passes it through prompt-influenced code. The formatter resolves each dotted segment directly, returning class references, base classes, module globals, and object dictionaries. Runtime string concatenation also lets attackers assemble blocklisted dunder names that static name checks would otherwise reject.

The result is a read primitive against internal object state. Attackers do not obtain a full in-process execution chain, but exposed __globals__ and __dict__ values frequently contain secrets, API keys, and callable references that support follow-on attacks.

Root Cause

The sandbox trusts a Python-level attribute filter while string formatting resolves attributes through a lower-level path that never invokes the filter. Blocklist enforcement also assumes attribute names appear as static tokens, ignoring runtime string assembly.

Attack Vector

Exploitation requires the ability to influence code or format strings evaluated by an agent whose execute_code tool is auto-approved. A malicious prompt supplies a format expression whose fields traverse dunder attributes, and the formatter returns the resolved values to the agent output.

python

# Security patch in approval/registry.py - additional risk-level gate
def is_yaml_approved(self, tool_name: str) -> bool:
    try:
        if tool_name not in self._yaml_approved_tools.get():
            return False
    except LookupError:
        return False
    if self.get_risk_level(tool_name) == "critical":
        return False
    return True
# Source: https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9

Detection Methods for CVE-2026-57120

Indicators of Compromise

Agent tool invocations containing format strings with dotted dunder field references such as {x.__class__}, {x.__globals__}, or {x.__bases__}
Runtime string concatenation in agent-executed code that assembles dunder names from fragments like "__" + "class" + "__"
Unexpected output containing serialized class metadata, module globals, or object dictionaries returned from execute_code

Detection Strategies

Inspect agent execution logs for calls to str.format or str.format_map on user-influenced templates
Alert on execute_code sandbox invocations that reference dunder attributes in returned data
Monitor for auto-approved tool executions where the approval registry did not enforce a critical-risk gate

Monitoring Recommendations

Enable verbose logging on the PraisonAI approval registry and correlate with prompt content
Track version metadata of the praisonaiagents package across deployment pipelines to identify hosts still below 1.6.59
Baseline expected execute_code outputs and flag responses containing Python object repr patterns

How to Mitigate CVE-2026-57120

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.59 or later across all agent deployments
Disable automatic approval for execute_code and require human confirmation for critical-risk tools
Audit prompt handling pipelines for opportunities where attackers can inject format strings

Patch Information

The fix is included in praisonaiagents 1.6.59, delivered in the PraisonAI v4.6.59 release. The upstream commit 2adfe7e hardens input validation and access controls, and adds a critical-risk gate in the approval registry. Full advisory details are published in GHSA-pv2j-rghr-v5r9.

Workarounds

Remove execute_code from the auto-approved tool list until the upgrade is complete
Reject prompt inputs that contain { and } format placeholders before passing them to code-execution tools
Isolate agent runtimes in restricted containers with no access to secrets or credential material

bash

# Upgrade to the patched release
pip install --upgrade "praisonaiagents>=1.6.59"

# Verify installed version
python -c "import praisonaiagents; print(praisonaiagents.__version__)"