CVE-2026-47392: MervinPraison PraisonAI sandbox escape in execute_code tool

CVE-2026-47392 · Severity: critical · CVSS 9.9 · Published 2026-07-21

PraisonAI is a system used to manage teams of AI agents. A security flaw in its code execution tool allows an attacker to bypass safety restrictions and run unauthorized commands on the underlying server. This could lead to the theft of sensitive data, exposure of API keys, or full control over the host system by anyone who can influence the AI's input.

Technologies: MervinPraison PraisonAI Agents, praisonai (PyPI), praisonaiagents (PyPI). Vendors: MervinPraison, PyPI.

Quick answers

Is CVE-2026-47392 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47392 being exploited in the wild.
How severe is CVE-2026-47392?
Critical severity, with a CVSS score of 9.9, published 21 July 2026.
Which products and versions are affected?
praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.40; praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.40.
Is there a fix for CVE-2026-47392?
Yes. praisonai (PyPI): upgrade to 4.6.40 or later; praisonaiagents (PyPI): upgrade to 1.6.40 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47392 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47392?
Check whether you run MervinPraison PraisonAI Agents, praisonai (PyPI) or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai (PyPI): upgrade to 4.6.40 or later
    pip install "praisonai>=4.6.40"
  • praisonaiagents (PyPI): upgrade to 1.6.40 or later
    pip install "praisonaiagents>=1.6.40"

Technical details

A sandbox escape exists in `praisonaiagents/tools/python_tools.py` within the `execute_code()` function's subprocess sandbox mode. The vulnerability stems from multiple gaps in AST-based validation: the `__self__` attribute is not blocked, allowing access to the `builtins` module via `print.__self__`; the `vars()` function is not restricted; and the dangerous-call check only inspects `ast.Name` nodes, missing `ast.Attribute` or `ast.Subscript` calls. By combining these gaps with runtime string construction to bypass literal checks, an attacker can retrieve `__import__` and execute arbitrary OS commands. This bypass is notable for surviving previous patches related to frame traversal and string subclassing. A fix is available in PraisonAI 4.6.40 and praisonaiagents 1.6.40.

Affected products

  • MervinPraison PraisonAI < 4.6.40
  • MervinPraison praisonaiagents < 1.6.40

Identifiers

  • CVE-2026-47392
  • GHSA-4mr5-g6f9-cfrh
  • PYSEC-2026-463
  • PYSEC-2026-483

Timeline

  • 2026-05-19: patched: Fix merged in PR #1684
  • 2026-07-21: disclosed: CVE-2026-47392 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.