9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47392

CVE-2026-47392: PraisonAI vulnerable to sandbox escape via `print.self` builtins module leak in `execute_code` (subprocess mode)

Summary

execute_code() in praisonaiagents/tools/python_tools.py (v1.6.37, subprocess sandbox mode) can be fully bypassed using print.__self__ to retrieve the real Python builtins module, from which __import__ can be extracted via vars() and runtime string construction. This achieves arbitrary OS command execution on the host, completely defeating the sandbox.

This is a novel bypass that survives all patches for CVE-2026-39888 (frame traversal), CVE-2026-34938 (str subclass), and CVE-2026-40158 (type.__getattribute__ trampoline).

Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — 9.9 Critical

Root Cause

Three independent gaps in the AST-based security validation:

Gap 1: `self` missing from `_blocked_attrs`

In CPython, all built-in functions (C-level functions) have a __self__ attribute that returns the module they belong to. The built-in functions in safe_builtins (print, len, range, etc.) are the real CPython built-in functions, so print.__self__ returns <module 'builtins' (built-in)>.

The _blocked_attrs frozenset (line 52) does NOT include __self__. The AST check at line 74 only blocks attributes that are IN this set, so print.__self__ passes.

Gap 2: `vars` not blocked as callable or attribute

builtins.vars(obj) returns obj.__dict__. The function name vars is not in the AST Call blocklist (line 83: only blocks exec, eval, compile, __import__, , , , , , ). And is not in for attribute access.

Miggo Vulnerability Database

→

CVE-2026-47392

CVE-2026-47392:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
praisonaiagents	pip	<= 1.6.39	1.6.40
PraisonAI	pip	<= 4.6.39	4.6.40

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a sandbox escape in the execute_code function in praisonaiagents/tools/python_tools.py. The root cause is incomplete AST-based validation of the code to be executed. Specifically, the validation logic in the _validate_code_ast function did not block access to the __self__ attribute of built-in functions, nor did it block the use of the vars() function. This allowed an attacker to craft a payload that uses print.__self__ to get a reference to the builtins module, and then use vars() to get the module's __dict__, which contains dangerous functions like __import__. By dynamically constructing the string "__import__" to bypass string-based checks, the attacker could then use __import__('os').popen('id').read() to execute arbitrary commands on the host system. The patch addresses these gaps by adding __self__ and vars to the respective blocklists within the AST validation logic and enhances checks for dangerous calls made via attribute access.

Vulnerable functions

execute_code

src/praisonai-agents/praisonaiagents/tools/python_tools.py

This is the main entry point function that receives the malicious code. When called with `sandbox_mode="sandbox"`, it uses a flawed sandboxing mechanism that can be bypassed.

_execute_code_sandboxed

src/praisonai-agents/praisonaiagents/tools/python_tools.py

This function is responsible for executing code in a sandboxed environment. Before the patch, it contained inadequate validation logic (or called a function with inadequate logic) that allowed an attacker to escape the sandbox. The patch adds a call to the hardened `_validate_code_ast` function to prevent the bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

9.9

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-47392: PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

Summary

Severity

Root Cause

Gap 1: __self__ missing from _blocked_attrs

Gap 2: vars not blocked as callable or attribute

CVE-2026-47392:

9.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

9.9

9.9

Technical Details

CVE-2026-47392: PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

Summary

Severity

Root Cause

Gap 1: __self__ missing from _blocked_attrs

Gap 2: vars not blocked as callable or attribute

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Gap 3: AST Call check only catches ast.Name nodes

Gap 4: Runtime string construction bypasses string constant check

Proof of Concept

Step-by-step bypass analysis:

Impact

Affected

Remediation

Immediate fix

Additional hardening

Fundamental recommendation

CVE-2026-47392: PraisonAI vulnerable to sandbox escape via `print.self` builtins module leak in `execute_code` (subprocess mode)

Gap 1: `self` missing from `_blocked_attrs`

Gap 2: `vars` not blocked as callable or attribute

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

CVE-2026-47392: PraisonAI vulnerable to sandbox escape via `print.self` builtins module leak in `execute_code` (subprocess mode)

Gap 1: `self` missing from `_blocked_attrs`

Gap 2: `vars` not blocked as callable or attribute

Vulnerability Intelligence
Miggo AI

Gap 3: AST `Call` check only catches `ast.Name` nodes