PraisonAI is a multi‑agent teams system. Before version 4.6.40 (and praisonaiagents 1.6.40), its execute_code() function in python_tools.py (subprocess sandbox mode) can be entirely bypassed by leaking the true Python builtins module with print.__self__. An attacker can then extract __import__ via vars() and use runtime string construction to execute arbitrary OS commands, defeating the sandbox. This novel bypass survives all previous CVE patches (CVE-2026-39888, CVE-2026-34938, CVE-2026-40158). The flaw thus represents a severe command‑injection (CWE‑184) and protection‑mechanism‑failure (CWE‑693) vulnerability that allows full host OS command execution.

MervinPraison’s PraisonAI products prior to version 4.6.40 (pre‑release) and the praisonaiagents module before 1.6.40 are affected. The fix was introduced in PraisonAI 4.6.40 and praisonaiagents 1.6.40, so any deployment using older releases remains vulnerable.

The CVSS score of 9.9 indicates critical severity. The EPSS score of <1% shows exploitation probability is very low, and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires invoking execute_code() with malicious payload, implying a local or compromised‑access vector. Because the bypass uses print.__self__ to leak builtins and survive previous patchwork, an attacker who gains execution can run arbitrary OS commands on the host, making this a high‑priority risk that also touches CWE‑184 and CWE‑693.