The vulnerability exists in the execute_code() function of praisonaiagents/tools/python_tools.py (version 1.6.37 and earlier), where the subprocess sandbox can be fully bypassed by using print.__self__ to retrieve the real Python builtins module. From there, the __import__ function can be accessed via vars() and constructed at runtime, allowing an attacker to execute arbitrary OS commands on the host system. This novel bypass circumvents all prior mitigations for CVE-2026-39888, CVE-2026-34938, and CVE-2026-40158. The issue is fixed in PraisonAI version 4.6.40 and praisonaiagents version 1.6.40.

Successful exploitation results in complete sandbox escape and arbitrary operating system command execution with the privileges of the PraisonAI process. This leads to full compromise of the host system's confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS score of 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability.

An official fix is available in PraisonAI version 4.6.40 and praisonaiagents version 1.6.40. Users should upgrade to these versions or later to remediate this vulnerability. Patch status is not explicitly stated in the vendor advisory content, but the description confirms the fix is included starting from these versions. No additional mitigations are specified.