CVE-2026-60085: PraisonAI Subprocess Sandbox Lacks Command and Path Restrictions
Summary
CVE-2026-60085: Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allow_subprocess, allowed_paths, blocked_paths, allowed_commands, blocked_commands, allowed_imports, an... Affects praisonai versions < 4.6.78. Fixed in 4.6.78. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PraisonAI is an open-source framework designed for building AI applications. It provides a sandbox environment for executing untrusted code safely. The framework includes a SecurityPolicy configuration that aims to restrict subprocess execution, file access, and command execution to protect against malicious activities. However, a significant vulnerability exists in the default Subprocess Sandbox backend, which fails to enforce these restrictions.
Vulnerability Detail
The vulnerability arises from the Subprocess Sandbox implementation in PraisonAI, where the SecurityPolicy's restrictions on subprocess creation, file access, and command execution are not enforced. Despite the configuration allowing for strict security policies, the backend does not check against blocked commands, paths, or imports. This oversight can lead to unauthorized access to sensitive files, execution of destructive commands, and overall compromise of the system's security. The root cause is that only a subset of the SecurityPolicy fields is utilized, leaving critical security measures unenforced.
How To Fix
Latest published version: 4.7.16 as of 22 Oct 2026
pip install --upgrade "praisonai==4.7.16"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.6.78
This is the first release that contains the fix.
pip install --upgrade "praisonai==4.6.78"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider using the native backend (Landlock/Seatbelt) for untrusted code execution instead of the Subprocess Sandbox. This backend enforces the necessary security policies effectively.
Conclusion
The PraisonAI framework has a critical vulnerability in its Subprocess Sandbox that allows untrusted code to bypass security restrictions. It is essential to update to the patched version (4.6.78) to mitigate risks. Users should also consider alternative backends for enhanced security until they can upgrade.
See every vulnerability recorded for praisonai →
FAQ
CVE-2026-60085 is a vulnerability in the PraisonAI framework that allows untrusted code to bypass security restrictions in the Subprocess Sandbox.
The risks include unauthorized access to sensitive files, execution of harmful commands, and potential system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, switch to the native backend (Landlock/Seatbelt) for executing untrusted code as a temporary measure.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for praisonai.
