PraisonAI sandbox escape found via four missing attributes

CVE-2026-39888 in PraisonAI before 1.5.115 lets execute_code() escape its sandbox through __traceback__, tb_frame, f_back and f_builtins. The chain reaches the real builtins dictionary, enabling arbitrary code execution and theft of environment secrets. CVSS 3.1 score is 9.9.

• Subprocess blocklist has 11 attributes versus over 30 in the direct path
• Chain __traceback__ → tb_frame → f_back → f_builtins reaches real builtins
• CVSS 3.1 score 9.9 with changed scope beyond the sandbox
• Fixed in 1.5.115; container isolation recommended as compensating control