PraisonAI's praisonaiagents before version 1.6.59 contains a protection mechanism failure (CWE-693) in its execute_code sandbox mode. The vulnerability arises because the sandbox permits runtime assembly of blocklisted dunder names and allows str.format or str.format_map to resolve dotted fields through C-level attribute access that bypasses the _safe_getattr function. This bypass exposes class, qualified-name, base-class, globals, and object-dictionary attributes to code influenced by prompts when automatic approval is granted. This creates a high-impact read primitive without requiring a full in-process execution chain. The vulnerability is addressed in praisonaiagents version 1.6.59.

An attacker with limited privileges (PR:L) can exploit this vulnerability remotely (AV:N) without user interaction (UI:N) to read sensitive class and object attributes, potentially leaking confidential information. The vulnerability does not allow integrity or availability impacts but results in a high confidentiality impact. This could lead to unauthorized disclosure of internal program state or sensitive data.

Upgrade praisonaiagents to version 1.6.59 or later, where this vulnerability is fixed. No other mitigation is indicated or required as the vendor has provided an official fix.