PraisonAI vulnerable to sandbox escape via print.__self__ builtins module leak in execute_code (subprocess mode)
- Product
- praisonaiagents
- CVE
- CVE-2026-47392
- Affected
- praisonaiagents <= 1.6.39; PraisonAI <= 4.6.39
- Fixed in
- 1.6.40 (praisonaiagents), 4.6.40 (PraisonAI)
Last verified against sources: October 26, 2026
Am I affected?
praisonaiagents: affected praisonaiagents <= 1.6.39; PraisonAI <= 4.6.39. Fixed in 1.6.40 (praisonaiagents), 4.6.40 (PraisonAI).
- Check your version: run
pip show praisonaiagents. Versions <= 1.6.39 of praisonaiagents are affected. [1] - Check your version: run
pip show PraisonAI. Versions <= 4.6.39 of PraisonAI are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "praisonaiagents>=1.6.40"(first patched version 1.6.40). [1] - Upgrade to the fixed version: run
pip install --upgrade "PraisonAI>=4.6.40"(first patched version 4.6.40). [1] - Consider using OS-level sandboxing (seccomp, namespaces, gVisor). [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- execute_code() in praisonaiagents/tools/python_tools.py (v1.6.37, subprocess sandbox mode) can be fully bypassed using print.__self__ to retrieve the real Python builtins module. [1]
- This achieves arbitrary OS command execution on the host, completely defeating the sandbox. [1]
- This is a novel bypass that survives all patches for CVE-2026-39888 (frame traversal), CVE-2026-34938 (str subclass), and CVE-2026-40158 (type.__getattribute__ trampoline). [1]
- The _blocked_attrs frozenset (line 52) does NOT include __self__. [1]
Impact
- An attacker who can influence agent input (via prompt injection, malicious documents, or direct code submission) can execute arbitrary commands on the host system. [1]
- Read/write any file accessible to the process. [1]
- Exfiltrate environment variables, API keys, and credentials. [1]
- Install persistent backdoors. [1]
What was done
Sources
- GHSA-4mr5-g6f9-cfrh — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-47392] PraisonAI vulnerable to sandbox escape via print.__self__ builtins module leak in execute_code (subprocess mode)
Product: praisonaiagents | Affected: praisonaiagents <= 1.6.39; PraisonAI <= 4.6.39 | Fixed in: 1.6.40 (praisonaiagents), 4.6.40 (PraisonAI)
Summary: execute_code() in praisonaiagents/tools/python_tools.py (v1.6.37, subprocess sandbox mode) can be fully bypassed using print.__self__ to retrieve the real Python builtins module.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/05/cve-2026-47392-praisonaiagentsCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-47392
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.