Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. praisonai
  4. ›
  5. CVE-2026-47392

CVE-2026-47392: PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

May 29, 2026

execute_code() in praisonaiagents/tools/python_tools.py (v1.6.37, subprocess sandbox mode) can be fully bypassed using print.__self__ to retrieve the real Python builtins module, from which __import__ can be extracted via vars() and runtime string construction. This achieves arbitrary OS command execution on the host, completely defeating the sandbox.

This is a novel bypass that survives all patches for CVE-2026-39888 (frame traversal), CVE-2026-34938 (str subclass), and CVE-2026-40158 (type.__getattribute__ trampoline).


References

  • github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4mr5-g6f9-cfrh
  • github.com/advisories/GHSA-4mr5-g6f9-cfrh
  • nvd.nist.gov/vuln/detail/CVE-2026-47392

Code Behaviors & Features

Detect and mitigate CVE-2026-47392 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 4.6.40

Fixed versions

  • 4.6.40

Solution

Upgrade to version 4.6.40 or above.

Impact 9.9 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-184: Incomplete List of Disallowed Inputs
  • CWE-693: Protection Mechanism Failure

Source file

pypi/praisonai/CVE-2026-47392.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 23 Jun 2026 12:23:37 +0000.