Description

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to inject invalid http_proxy and https_proxy environment variables and does not establish an operating-system network boundary. Programs that ignore those proxy variables can open sockets directly, allowing supposedly isolated commands to reach localhost, internal services, cloud metadata, or external hosts and potentially exfiltrate data. An initial remediation was released in version 1.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-15T11:17:10.733Z",
  "pubdate": "2026-09-15T11:17:10.733Z",
  "executiveSummary": "The PraisonAI multi-agent system, specifically within the SandboxExecutor component, contains a critical security vulnerability involving insufficient network isolation.\nThe vulnerability type is an ineffective security control (isolation bypass) stemming from reliance on proxy environment variables rather than OS-level network restrictions.\nAffected versions include PraisonAI from 1.2.3 through 1.7.2.\nThe risk implication is that processes intended to run in a sandboxed, network-isolated state can circumvent these restrictions.\nAn attacker capable of executing code within the sandbox can bypass the intended network isolation by using utilities or code that ignore http_proxy and https_proxy settings.\nThis allows for unauthorized communication with localhost services, internal network resources, cloud metadata APIs (e.g., IMDS), or arbitrary external hosts, potentially leading to sensitive data exfiltration or internal network reconnaissance.",
  "technicalDetails": "The vulnerability resides in the src/praisonai-ts/src/cli/features/sandbox-executor.ts component, specifically within the buildEnv() function.\nThe root cause of this security failure is the reliance on environment variable injection—specifically http_proxy and https_proxy—to enforce network isolation within the SandboxExecutor.\nThis approach is fundamentally flawed as it relies on the cooperation of the process running inside the sandbox to respect these proxy settings. Many binaries, custom scripts, and low-level socket-based applications bypass these environment variables entirely.\nBecause the SandboxExecutor does not implement operating-system-level network boundaries (such as Linux network namespaces, seccomp filters, or firewall rules like iptables/nftables), there is no hardware or kernel-level enforcement to prevent egress or ingress traffic.\nThe attack flow proceeds as follows: 1. An attacker triggers the execution of a malicious or adversarial agent within the PraisonAI SandboxExecutor environment. 2. Since the isolation is non-existent at the OS level, the attacker initiates a standard network socket request (e.g., using raw sockets, non-proxy-aware libraries, or direct syscalls). 3. The sandbox environment permits the traffic because it lacks an enforced network policy. 4. The process reaches out to sensitive endpoints such as 169.254.169.254 to exfiltrate cloud credentials, interacts with internal services accessible via localhost, or performs arbitrary requests to external command-and-control (C2) infrastructure.\nThe absence of a sandbox perimeter allows the compromised agent to bypass the intended confinement completely. This vulnerability is particularly severe in cloud environments where the SandboxExecutor might run on a host with highly sensitive IAM roles or access to private internal API endpoints. Post-exploitation, the attacker can leverage the unchecked network access to pivot further into the internal infrastructure, perform port scanning, or steal metadata and authentication tokens that the host process might be authorized to access."
}