CVE-2026-47392
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
In PraisonAI before version 4.6.40 (corresponding to praisonaiagents version 1.6.40), a vulnerability exists in the `execute_code()` function in `praisonaiagents/tools/python_tools.py`. An attacker can bypass the subprocess sandbox by using `print.__self__` to access the real Python `builtins` module, then extract `__import__` via `vars()` and runtime string construction, achieving arbitrary OS command execution on the host.
Risk Assessment
This vulnerability allows complete bypass of the sandbox mechanism and execution of arbitrary commands on the host, potentially leading to system compromise, data theft, or lateral movement within the organization's network.
Recommendation
Immediately upgrade PraisonAI to version 4.6.40 or later and praisonaiagents to version 1.6.40 or later. If upgrading is not possible, temporarily disable the `execute_code()` function or restrict access to the system.
Original NVD description (English source)
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `execute_code()` in `praisonaiagents/tools/python_tools.py` (v1.6.37, subprocess sandbox mode) can be fully bypassed using `print.__self__` to retrieve the real Python `builtins` module, from which `__import__` can be extracted via `vars()` and runtime string construction. This achieves arbitrary OS command execution on the host, completely defeating the sandbox. This is a novel bypass that survives all patches for CVE-2026-39888 (frame traversal), CVE-2026-34938 (str subclass), and CVE-2026-40158 (`type.__getattribute__` trampoline). PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain an updated fix.