CVE-2026-47392
Received Received - Intake

Command Injection Bypass in PraisonAI

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `execute_code()` in `praisonaiagents/tools/python_tools.py` (v1.6.37, subprocess sandbox mode) can be fully bypassed using `print.__self__` to retrieve the real Python `builtins` module, from which `__import__` can be extracted via `vars()` and runtime string construction. This achieves arbitrary OS command execution on the host, completely defeating the sandbox. This is a novel bypass that survives all patches for CVE-2026-39888 (frame traversal), CVE-2026-34938 (str subclass), and CVE-2026-40158 (`type.__getattribute__` trampoline). PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain an updated fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-47392
EUVD
EUVD-2026-46282

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
praisonai praisonai to 4.6.40 (exc)
praisonai praisonaiagents to 1.6.40 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47392 is a critical sandbox escape flaw in PraisonAI's agents package. It allows attackers to bypass the subprocess sandbox in execute_code() by using print.__self__ to access Python's builtins module, then extracting __import__ via vars() and runtime string construction. This enables arbitrary OS command execution on the host system.

Detection Guidance

Check if PraisonAI or praisonaiagents versions are below 4.6.40 or 1.6.40 respectively. Inspect logs for suspicious code execution attempts in python_tools.py. Monitor for unexpected system commands like 'id' or file access patterns.

Impact Analysis

This vulnerability allows full system compromise. Attackers could execute arbitrary commands, access sensitive files, steal credentials, pivot across networks, or install persistent backdoors. The default sandbox mode makes most installations vulnerable without immediate patching.

Compliance Impact

This vulnerability allows arbitrary OS command execution on the host system, which could lead to unauthorized access to sensitive data, data exfiltration, or system compromise. For GDPR, this could result in violations of data integrity and confidentiality requirements. For HIPAA, it may lead to unauthorized access to protected health information, violating security and privacy rules.

Mitigation Strategies

Upgrade to PraisonAI 4.6.40 and praisonaiagents 1.6.40 immediately. Disable subprocess sandbox mode if not required. Implement additional sandboxing layers like isolated-vm or containerized execution. Review and block dangerous Python functions in callable lists.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47392. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart