CVE-2026-47392: PraisonAI Sandbox Escape via print.__self__ Builtins Leak

Vulnerability Overview

CVE-2026-47392 is a critical sandbox escape vulnerability (CVSS 9.9) in the PraisonAI agent framework. Classified under CWE-184 (Incomplete List of Disallowed Inputs) and CWE-693 (Protection Mechanism Failure), the flaw resides in PraisonAI's execute_code function when operating in subprocess mode.

The root cause is a failure to restrict access to Python's built-in namespace. An attacker-controlled code snippet can reference print.__self__ to obtain a handle to the builtins module from within the supposedly sandboxed execution context. From there, standard Python introspection chains — __import__, __class__.__mro__, and similar — give an attacker full access to the host Python interpreter, enabling arbitrary code execution outside the sandbox.

The impact is severe: any environment that passes untrusted or user-supplied code through PraisonAI's execute_code subprocess path is exposed to full host-level compromise.

Affected Software

• praisonaiagents (pip) — versions <= 1.6.39
• PraisonAI (pip) — versions <= 4.6.39

No patch has been released as of the disclosure date (2026-05-29). Organisations running either package should treat all versions in scope as vulnerable until a fixed release is confirmed upstream.

Exploitation Status

A public proof-of-concept (PoC) is available. This elevates the threat from theoretical to immediately actionable for any attacker with network or application-layer access to a PraisonAI deployment that processes untrusted code. Defenders should treat this as actively exploitable and prioritise detection and mitigation accordingly. The vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalogue, but the combination of a 9.9 CVSS score and a public PoC makes rapid weaponisation likely.

Detection Coverage

Our detection rule for CVE-2026-47392 targets the behavioural indicators that distinguish a sandbox escape attempt from legitimate PraisonAI usage. The core logic looks for process execution patterns consistent with the execute_code subprocess spawning unexpected child processes, access to sensitive Python interpreter internals, and post-escape activity such as shell invocation or file-system access from within a PraisonAI worker process.

We ship detection content across seven SIEM platforms:

• Microsoft Sentinel (KQL) — queries DeviceProcessEvents and CommonSecurityLog for anomalous child-process lineage under PraisonAI worker processes.
• Splunk (SPL) — correlates process creation and Python interpreter telemetry to surface print.__self__-style builtins access patterns.
• Elastic (EQL) — uses sequence queries to chain the subprocess spawn event with subsequent suspicious system calls.
• IBM QRadar (AQL) — rule targets network and process flow events indicating post-escape lateral movement from agent processes.
• Sumo Logic — log search query focuses on PraisonAI container or host process trees with anomalous interpreter invocations.
• Google Chronicle (YARAL) — UDM-based rule matches process events where a PraisonAI parent spawns an unexpected shell or system utility.
• CrowdStrike (CQL) — Falcon telemetry rule detects the process injection and interpreter abuse patterns characteristic of this exploit chain.

Recommended Response

Until a patched release is available, consider restricting which inputs are permitted to reach execute_code, running PraisonAI in isolated environments with no outbound network access, and alerting on any child-process spawned by PraisonAI worker processes that invokes a shell interpreter.

Full detection queries, MITRE ATT&CK mapping, and atomic test cases are available on the CVE-2026-47392 detection page.