Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. praisonai
  4. ›
  5. CVE-2026-47392

CVE-2026-47392: PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

May 29, 2026

execute_code() in praisonaiagents/tools/python_tools.py (v1.6.37, subprocess sandbox mode) can be fully bypassed using print.__self__ to retrieve the real Python builtins module, from which __import__ can be extracted via vars() and runtime string construction. This achieves arbitrary OS command execution on the host, completely defeating the sandbox.

This is a novel bypass that survives all patches for CVE-2026-39888 (frame traversal), CVE-2026-34938 (str subclass), and CVE-2026-40158 (type.__getattribute__ trampoline).


References

  • github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4mr5-g6f9-cfrh
  • github.com/advisories/GHSA-4mr5-g6f9-cfrh
  • nvd.nist.gov/vuln/detail/CVE-2026-47392

Code Behaviors & Features

Detect and mitigate CVE-2026-47392 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 4.6.40

Fixed versions

  • 4.6.40

Solution

Upgrade to version 4.6.40 or above.

Impact 9.9 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-184: Incomplete List of Disallowed Inputs
  • CWE-693: Protection Mechanism Failure

Source file

pypi/praisonai/CVE-2026-47392.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:25 +0000.