Detect PraisonAI Sandbox Escape via print.__self__ Builtins Leak in execute_code in Google Chronicle
Detects exploitation of CVE-2026-47392, a critical sandbox escape vulnerability in PraisonAI (praisonaiagents <= 1.6.39, PraisonAI <= 4.6.39). The flaw allows attackers to leak the Python builtins module through `print.__self__` within the `execute_code` subprocess mode, bypassing sandbox restrictions and achieving arbitrary code execution on the host. A public proof-of-concept is available.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2026_47392_praisonai_sandbox_escape {
meta:
author = "df00tech Detection Engineering"
description = "Detects CVE-2026-47392 PraisonAI sandbox escape via print.__self__ builtins leak"
severity = "CRITICAL"
priority = "HIGH"
reference = "https://github.com/advisories/GHSA-4mr5-g6f9-cfrh"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
(
re.regex($e.principal.process.command_line, `(?i)praisonai`) or
re.regex($e.principal.process.command_line, `(?i)praisonaiagents`)
)
(
re.regex($e.principal.process.command_line, `print\.__self__`) or
re.regex($e.principal.process.command_line, `__builtins__`) or
re.regex($e.principal.process.command_line, `execute_code`) or
(
re.regex($e.principal.process.command_line, `subprocess`) and
re.regex($e.principal.process.command_line, `shell\s*=\s*True`)
)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting CVE-2026-47392 exploitation through process launch events exhibiting PraisonAI invocation combined with builtins module leak or subprocess shell execution patterns.
Data Sources
Required Tables
False Positives & Tuning
- Authorized security red team exercises targeting PraisonAI deployments in documented test windows
- Python developers using print.__self__ for legitimate introspection outside of PraisonAI context
- CI/CD pipelines running PraisonAI integration tests that include subprocess-based tool calls
- ML/AI research environments where sandbox restrictions are intentionally disabled for experimentation
Other platforms for CVE-2026-47392
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PraisonAI Builtins Leak via print.__self__ in execute_code
Expected signal: Process spawn: python3 executing praisonaiagents code_tools module; child process executing 'id' command via os.popen; stdout contains 'SANDBOX_ESCAPE_SUCCESS' followed by uid/gid output
- Test 2PraisonAI Sandbox Escape to Reverse Shell
Expected signal: Process tree: python3 -> praisonaiagents -> bash -c 'bash -i' with network connection to 127.0.0.1:4444; network telemetry showing TCP connection from python process
- Test 3PraisonAI Sandbox Escape with Credential File Exfiltration
Expected signal: File open event on /tmp/lab_creds.txt by python process; outbound HTTP POST to 127.0.0.1:8888 from PraisonAI process; process command line contains __builtins__ and os.system invocation
Unlock Pro Content
Get the full detection package for CVE-2026-47392 including response playbook, investigation guide, and atomic red team tests.