CVE-2026-47392: PraisonAI Sandbox Bypass RCE Vulnerability

CVE-2026-47392 Overview

CVE-2026-47392 is a sandbox escape vulnerability in PraisonAI, a multi-agent teams framework. The flaw resides in the execute_code() function within praisonaiagents/tools/python_tools.py and affects PraisonAI versions prior to 4.6.40 and praisonaiagents versions prior to 1.6.40. Attackers can bypass the subprocess sandbox by using print.__self__ to retrieve the real Python builtins module, then extracting __import__ via vars() and runtime string construction. This technique achieves arbitrary operating system command execution on the host. The bypass survives prior patches for CVE-2026-39888, CVE-2026-34938, and CVE-2026-40158.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on the host, completely defeating the Python sandbox and compromising the agent runtime.

Affected Products

PraisonAI versions prior to 4.6.40
praisonaiagents versions prior to 1.6.40
praisonaiagents/tools/python_tools.py (v1.6.37 subprocess sandbox mode)

Discovery Timeline

2026-07-21 - CVE-2026-47392 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-47392

Vulnerability Analysis

The vulnerability is classified under [CWE-184] (Incomplete List of Disallowed Inputs). PraisonAI's execute_code() function implements a subprocess sandbox intended to restrict access to dangerous Python built-ins. The sandbox filters known escape primitives such as frame traversal, str subclass tricks, and type.__getattribute__ trampolines that were used in earlier bypasses. However, the sandbox does not account for the fact that safe built-ins like print expose __self__, a direct reference to the real builtins module. From this reference, attackers reach __import__ and load arbitrary modules including os and subprocess.

Root Cause

The root cause is an incomplete deny-list approach to sandboxing untrusted Python code. Prior patches addressed specific escape techniques individually rather than restricting the underlying attribute graph. The print built-in remained accessible and retained a __self__ reference to builtins, providing a stable path to __import__ through vars() and runtime string construction.

Attack Vector

An attacker with the ability to submit code to the PraisonAI agent's execute_code() tool can trigger the bypass. The attack requires low privileges and no user interaction. Because PraisonAI is deployed as a multi-agent system, prompts routed through language models can influence code submitted to the sandbox. Successful exploitation grants arbitrary OS command execution in the host process context.

The patch in PraisonAI 4.6.40 tightens the sandbox and adds hardening across related tool modules, including URL validation in mentions.py and network validation additions in spider_tools.py.

python

# Patch excerpt: URL validation added in mentions.py
def _process_url_mention(self, url: str) -> Optional[str]:
    """Process @url:https://... mention."""
    try:
        from praisonaiagents.tools.spider_tools import SpiderTools

        if not SpiderTools()._validate_url(url):
            return f"# URL: {url}\n[Blocked: URL is not allowed]"

        import urllib.request

        req = urllib.request.Request(

Source: GitHub Commit b0d8f77

Detection Methods for CVE-2026-47392

Indicators of Compromise

Child processes spawned by the PraisonAI agent runtime that invoke os, subprocess, or shell binaries such as /bin/sh, bash, or cmd.exe.
Sandbox input strings containing print.__self__, vars(, or dynamic construction of the string __import__.
Outbound network connections initiated from the Python interpreter running PraisonAI tools to unexpected destinations.

Detection Strategies

Instrument the execute_code() tool to log submitted code payloads and flag references to __self__, __builtins__, or __import__.
Monitor process ancestry for the PraisonAI process tree and alert on unexpected shell or interpreter children.
Compare deployed praisonaiagents package versions against the fixed release (1.6.40) using software inventory data.

Monitoring Recommendations

Enable process creation auditing on hosts running PraisonAI and forward events to a centralized log store.
Baseline normal network egress from agent workloads and alert on deviations.
Track filesystem writes to sensitive paths from the PraisonAI runtime user account.

How to Mitigate CVE-2026-47392

Immediate Actions Required

Upgrade PraisonAI to version 4.6.40 and praisonaiagents to version 1.6.40 without delay.
Audit any historical execute_code() invocations for the bypass patterns identified above.
Rotate credentials and secrets accessible from hosts that ran vulnerable versions.

Patch Information

The fix is delivered in PraisonAI 4.6.40 and praisonaiagents 1.6.40. Details are available in GitHub Pull Request #1684, GitHub Commit b0d8f77, and GHSA-4mr5-g6f9-cfrh.

Workarounds

Disable the execute_code() tool in agent configurations until the upgrade is applied.
Run PraisonAI in an isolated container with a read-only filesystem and no outbound network access.
Restrict which users and agents can submit code to the Python tool through application-layer access controls.

bash

# Upgrade to fixed versions
pip install --upgrade "praisonai>=4.6.40" "praisonaiagents>=1.6.40"

# Verify installed versions
pip show praisonai praisonaiagents | grep -E "Name|Version"