CVE-2026-39888: CVSS 9.9 Sandbox Escape in PraisonAI Gives Attackers Full Code Execution

CVE-2026-39888 was disclosed on April 8. It is a sandbox escape vulnerability in PraisonAI that scores CVSS 9.9 — critical severity, the highest class. An attacker who can reach a PraisonAI instance over the network can break out of the sandbox execution environment and achieve remote code execution on the underlying host system.

What PraisonAI is

PraisonAI is an open-source multi-agent AI orchestration framework built on top of CrewAI and AutoGen. It’s widely used to build and deploy autonomous AI agents that execute code, browse the web, call external APIs, and coordinate across task pipelines. Because agents regularly process user-supplied inputs and dynamically generated code, the sandbox is the primary security boundary between the agent runtime and the host system.

What this vulnerability allows

Sandbox escapes at CVSS 9.9 are not narrow in scope. At this severity level, a successful exploit typically allows execution of arbitrary commands as the process user, read access to host filesystem contents, exfiltration of environment variables — which in PraisonAI deployments commonly includes API keys for OpenAI, Anthropic, and other LLM providers — and lateral movement to other services in the same network segment.

In cloud-hosted or container-based PraisonAI deployments, the blast radius depends on how tightly the container or VM is isolated. If the PraisonAI process has access to cloud metadata endpoints or mounted credentials, an attacker who achieves code execution can escalate further.

CVSS 9.9 in context

A 9.9 score requires: network-accessible attack vector, no authentication required, low attack complexity, and full compromise of confidentiality, integrity, and availability. The 0.1 gap to a perfect 10 typically reflects a narrow scope constraint. This is among the most severe classifications a vulnerability can receive.

Affected versions and fix

Full affected version ranges and an official patched release were not published at time of disclosure. Monitor the PraisonAI GitHub repository and its security advisories for patch availability.

Immediate actions

• If PraisonAI is reachable from any network — internal or external — treat this as active risk, not a future concern
• Isolate PraisonAI instances from broader infrastructure until a patched version is confirmed
• Audit and tighten any code execution configuration that allows agent-generated code to run with elevated permissions
• Rotate API keys and credentials accessible to the PraisonAI process; assume they may have been read if the instance was internet-accessible
• Review container or VM isolation policies for any hosted PraisonAI deployment

The broader pattern

CVE-2026-39888 follows a pattern that’s accelerating across AI developer tooling in 2026. Agent frameworks inherit execution models from research environments — where the priority is capability, not adversarial hardening. As these tools move from developer workstations to production deployments and enterprise infrastructure, vulnerabilities that were acceptable in a lab context become critical attack surface.

PraisonAI is not an edge case. Most multi-agent frameworks in active use today have similar sandbox assumptions. This disclosure should prompt a review of any AI agent framework running in an environment where compromise would matter.