PraisonAI's multi-agent system praisonaiagents versions prior to 1.5.115 contain a sandbox escape vulnerability in the execute_code() function. The sandbox mode runs user code in a subprocess with restricted builtins and an AST-based blocklist. However, the blocklist inside the subprocess wrapper only blocks 11 attribute names, missing four critical attributes (__traceback__, tb_frame, f_back, f_builtins) that enable frame traversal. By chaining these attributes through a caught exception, an attacker can access the real builtins dictionary and retrieve exec, allowing arbitrary code execution outside the sandbox. This violates secure design principles (CWE-657) and improper input validation (CWE-693). The vulnerability is rated critical with a CVSS 3.1 score of 10. The issue is fixed in version 1.5.115.

Successful exploitation allows an attacker with limited privileges (PR:L) to execute arbitrary code remotely (AV:N) without user interaction (UI:N), resulting in complete system compromise (C:H/I:H/A:H). This can lead to full confidentiality, integrity, and availability loss of the affected system running praisonaiagents versions before 1.5.115.

Upgrade praisonaiagents to version 1.5.115 or later, where this vulnerability is fixed. Since the product is not a cloud service and no official patch advisory is provided, users should apply the fixed version promptly. There is no indication that the vulnerability is mitigated by other means or that no action is required.