External risk intelligence

PraisonAI `execute_code()` Sandbox Bypass Allows OS Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-47392

PraisonAI is a multi-agent framework. While such systems are often used in internal development or backend data processing environments, they can be deployed as components of internet-facing applications, APIs, or web services, making network reachability possible depending on the specific implementation.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the PraisonAI multi-agent system, affecting its ability to securely execute code. This issue allows for the complete bypass of security sandboxing, potentially leading to arbitrary operating system command execution on the host system. This bypass circumvents previous patches for related vulnerabilities.

Code execution sandbox can be fully bypassed.
Impacts systems processing code or commands.
Verify relevance and exposure of PraisonAI.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access could compromise the system by crafting a special input that bypasses the code execution sandbox. This bypass allows the attacker to access core Python functionalities and construct commands to run directly on the host operating system, thereby completely circumventing the intended security measures.

Requires authenticated access.
Triggered by specially crafted input.
Leads to arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a bypass of the `execute_code()` function in PraisonAI could allow for arbitrary OS command execution on the host system. This bypass is novel and has successfully circumvented previous patches, potentially impacting the integrity and availability of the system.

Arbitrary OS command execution.
Bypass sandbox via `print.__self__`.
Complete loss of system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in PraisonAI allows for arbitrary OS command execution, bypassing sandboxing mechanisms. Identifying the specific instances of PraisonAI and praisonaiagents in use, confirming their network exposure and criticality, and then assigning ownership for remediation are the immediate first steps. Coordination with the vendor for updated versions is essential for a permanent fix.

Application and platform teams own remediation.
Verify affected PraisonAI instances and exposure.
Plan coordinated update and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI and why do people use it?

PraisonAI is a framework designed for building and managing multi-agent systems. It allows developers to create teams of AI agents that collaborate to solve complex tasks. It is frequently used for automated data processing, code generation, and backend orchestration where agents need to perform actions or run scripts to complete their workflows.

What does this CVE mean for the security of PraisonAI?

This vulnerability, tracked as CVE-2026-47392, involves a failure in the software's security sandbox. The weakness belongs to the CWE-693 (Protection Mechanism Failure) and CWE-184 (Incomplete Sanitization) classes. It allows a user to escape the restricted environment meant to safely run code, enabling them to execute unauthorized commands directly on the underlying operating system instead of just within the safe sandbox.

How can an attacker trigger this sandbox bypass?

An attacker triggers this by providing specially crafted input to the system that interacts with the `execute_code()` tool. By using specific Python built-in objects, the attacker can navigate around security filters and access restricted system modules. Note that standard, non-malicious code execution tasks that do not attempt to reach outside the environment do not trigger this vulnerability.

Is my system at risk if PraisonAI is not public?

Halo Surface Signal notes that while PraisonAI is often used for internal development, it can be integrated into internet-facing APIs or web services. If your deployment is reachable via a network, the risk is higher. You should assess whether your specific implementation exposes the agent interface to users or external systems, as the vulnerability requires authenticated access to reach the triggered code path.

What are the first steps to secure my PraisonAI deployment?

Your first step is to check your current version of PraisonAI and praisonaiagents. If you are using any version prior to 4.6.40 (PraisonAI) or 1.6.40 (praisonaiagents), you are affected. You should prioritize updating your software to these versions or higher, as they contain the necessary fix. After updating, ensure your team validates that the new versions are correctly deployed across your infrastructure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.