PraisonAI Sandbox Escape via print.__self__ Builtins Leak in execute_code

union DeviceProcessEvents, DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessCommandLine has_any ("praisonai", "praisonaiagents") or ProcessCommandLine has_any ("praisonai", "praisonaiagents")
| where ProcessCommandLine has_any ("print.__self__", "__builtins__", "execute_code", "subprocess") or InitiatingProcessCommandLine has_any ("print.__self__", "__builtins__", "execute_code")
| extend SuspiciousIndicator = case(
    ProcessCommandLine has "print.__self__", "BuiltinsLeak",
    ProcessCommandLine has "__import__", "DynamicImport",
    ProcessCommandLine has "os.system" or ProcessCommandLine has "subprocess.Popen", "ShellExecution",
    "Unknown"
  )
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, SuspiciousIndicator, RemoteIP, RemotePort
| order by TimeGenerated desc

index=* sourcetype IN ("WinEventLog:Security", "linux_secure", "osquery:results", "sysmon") 
("praisonai" OR "praisonaiagents")
| eval suspicious_args = if(match(cmdline, "print\.__self__|__builtins__|execute_code|__import__\s*\("), 1, 0)
| eval shell_exec = if(match(cmdline, "os\.system|subprocess\.Popen|subprocess\.run|os\.popen"), 1, 0)
| eval risk_score = suspicious_args * 60 + shell_exec * 40
| where risk_score > 0
| eval severity = case(risk_score >= 80, "critical", risk_score >= 60, "high", risk_score >= 40, "medium", true(), "low")
| table _time, host, user, cmdline, parent_cmdline, suspicious_args, shell_exec, risk_score, severity
| sort -risk_score

sequence by host.name with maxspan=2m
  [process where event.type == "start"
   and (process.name like~ "python*" or process.name like~ "praisonai*")
   and (process.command_line like~ "*praisonai*" or process.args like~ "*praisonaiagents*")]
  [process where event.type == "start"
   and (
     process.command_line like~ "*print.__self__*"
     or process.command_line like~ "*__builtins__*"
     or process.command_line like~ "*execute_code*"
     or (process.command_line like~ "*subprocess*" and process.command_line like~ "*shell=True*")
   )]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "Application", "Command", "Process Name"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Linux OS', 'SysmonForLinux')
AND (LOWER("Command") LIKE '%praisonai%' OR LOWER("Command") LIKE '%praisonaiagents%')
AND (
  LOWER("Command") LIKE '%print.__self__%'
  OR LOWER("Command") LIKE '%__builtins__%'
  OR LOWER("Command") LIKE '%execute_code%'
  OR (LOWER("Command") LIKE '%subprocess%' AND LOWER("Command") LIKE '%shell%')
)
LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=*windows* OR _sourceCategory=*linux* OR _sourceCategory=*endpoint*
| where (%"cmdline" matches "*praisonai*" or %"cmdline" matches "*praisonaiagents*")
| where (%"cmdline" matches "*print.__self__*"
  or %"cmdline" matches "*__builtins__*"
  or %"cmdline" matches "*execute_code*"
  or (%"cmdline" matches "*subprocess*" and %"cmdline" matches "*shell=True*"))
| eval risk = if(%"cmdline" matches "*print.__self__*", "BuiltinsLeak", if(%"cmdline" matches "*subprocess*", "ShellEscape", "SuspiciousExec"))
| count by _sourceHost, %"user", %"cmdline", risk
| order by _count desc

rule cve_2026_47392_praisonai_sandbox_escape {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-47392 PraisonAI sandbox escape via print.__self__ builtins leak"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-4mr5-g6f9-cfrh"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.principal.process.command_line, `(?i)praisonai`) or
      re.regex($e.principal.process.command_line, `(?i)praisonaiagents`)
    )
    (
      re.regex($e.principal.process.command_line, `print\.__self__`) or
      re.regex($e.principal.process.command_line, `__builtins__`) or
      re.regex($e.principal.process.command_line, `execute_code`) or
      (
        re.regex($e.principal.process.command_line, `subprocess`) and
        re.regex($e.principal.process.command_line, `shell\s*=\s*True`)
      )
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| CommandLine = /praisonai|praisonaiagents/i
| CommandLine = /print\.__self__|__builtins__|execute_code|(subprocess.*(shell\s*=\s*True))/
| eval SuspiciousPattern = case(
    CommandLine = /print\.__self__/, "BuiltinsLeak_CVE-2026-47392",
    CommandLine = /__builtins__/, "BuiltinsAccess",
    CommandLine = /subprocess.*shell.*True/, "SandboxShellEscape",
    "SuspiciousExec"
  )
| table timestamp, ComputerName, UserName, CommandLine, ParentBaseFileName, SuspiciousPattern
| sort -timestamp