CriticalVulnerability

GHSA-4mr5-g6f9-cfrh: PraisonAI vulnerable to sandbox escape via `print.self` builtins module leak in `execute_code` (subprocess mode)

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-47392GHSA-4mr5-g6f9-cfrh
Published: May 29, 2026
Record updated: October 9, 2026

Affected: PraisonAI <= 4.6.39, fixed in 4.6.40
praisonaiagents <= 1.6.39, fixed in 1.6.40
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.9%

Summary

PraisonAI's `execute_code()` in `praisonaiagents/tools/python_tools.py` (v1.6.37, subprocess sandbox mode) can be fully bypassed. Using `print.__self__` to reach the real `builtins` module, then `vars()` and runtime string construction to obtain `__import__`, lets an attacker run arbitrary OS commands on the host, defeating the sandbox. The bypass survives patches for CVE-2026-39888, CVE-2026-34938 and CVE-2026-40158, and the advisory rates it CVSS 9.9 Critical.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.9%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 14, 2026.
Disclosure date: May 29, 2026

Affected

Packages: PraisonAI@<= 4.6.39 (fixed: 4.6.40)
praisonaiagents@<= 1.6.39 (fixed: 1.6.40)

Classification

Attack type: Other
Attack sophistication: Trivial
AI component targeted: Agent
Impact: Confidentiality,
Integrity,
Availability
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-4mr5-g6f9-cfrh

First tracked: May 29, 2026 at 08:00 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 95% (self-assessed)

Summary

Mitigation

Related items