CVE-2026-47392 Details

A vulnerability in PraisonAI's code execution sandbox has been identified, allowing for arbitrary operating system command execution. This issue arises in PraisonAI Agents version 1.6.37 and prior, within the 'execute_code()' function of 'praisonaiagents/tools/python_tools.py'. The vulnerability exploits a gap in the sandboxing mechanism by using 'print.__self__' to access the real Python 'builtins' module. From there, the '__import__' function can be extracted and used to execute commands on the host system, effectively bypassing all security measures that were supposed to be in place. This vulnerability takes advantage of three independent gaps in the AST-based security validation, particularly in how the sandbox handles attribute access and callable functions, allowing the execution of harmful commands under the guise of legitimate operations.

Users can update to PraisonAI version 4.6.40 or PraisonAI Agents version 1.6.40, both of which contain the necessary fix. For those unable to update, a manual workaround involves adding 'vars' to the blocked attributes and implementing similar checks as the updated version.