Description

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist plus shadowed process and require properties. Code can use ({}).constructor.constructor to recover the real Function constructor, obtain process and process.mainModule.require, and reach host filesystem and subprocess APIs despite the advertised sandbox. Attackers who control codeMode input can read secrets, modify files, execute commands, or exhaust the host process. This issue is fixed in version 1.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-15T11:17:11.180Z",
  "pubdate": "2026-09-15T11:17:11.180Z",
  "executiveSummary": "A critical sandbox escape vulnerability exists in PraisonAI versions 1.4.0 through 1.7.2, specifically within the codeMode implementation in src/praisonai-ts/src/tools/builtins/code-mode.ts.\nThe vulnerability is characterized by improper input validation and an insufficient security sandbox, which allows for Arbitrary Code Execution (ACE) on the underlying host system.\nThe flaw originates from the use of the new Function() constructor within a with(sandbox) block, combined with a flawed security approach relying on blocklists and object shadowing.\nSuccessful exploitation allows an attacker to bypass intended restrictions to access host filesystem resources, execute arbitrary subprocesses, and exfiltrate sensitive environment secrets.\nThe risk is categorized as high, as it grants an attacker the ability to achieve full remote code execution on the server or workstation hosting the PraisonAI instance.\nExploitation requires the attacker to control the input passed to codeMode, effectively turning the intended utility into a malicious execution vector.",
  "technicalDetails": "The root cause of this vulnerability is the reliance on insecure JavaScript primitives for process isolation. The vulnerable component, codeMode, utilizes new Function() to execute arbitrary user-provided strings.\nThe application attempts to restrict this execution by wrapping the code within a with(sandbox) statement and implementing a source-code blocklist intended to filter out dangerous keywords or functions.\nFurthermore, the implementation attempts to shadow global objects such as process and require. However, this defense-in-depth strategy is fundamentally flawed because it fails to account for prototype chain traversal.\nAn attacker can bypass these restrictions by leveraging the constructor property. By accessing the constructor of a standard object literal ({}).constructor.constructor, the attacker can recover the reference to the original, unshadowed Function constructor.\nThis recovered reference effectively bypasses the scoped sandbox restrictions, allowing the attacker to regain access to the global scope of the Node.js process.\nOnce the global scope is regained, the attacker can access the process object and use process.mainModule.require to invoke internal or external modules, including those related to the filesystem (fs) or process execution (child_process).\nThe attack flow proceeds as follows: 1) The attacker submits a malicious payload to codeMode; 2) The payload accesses ({}).constructor.constructor to escape the with(sandbox) confinement; 3) The attacker restores access to process and require objects; 4) The attacker executes arbitrary shell commands or filesystem operations via the recovered APIs.\nBecause this execution occurs within the context of the PraisonAI host process, the payload inherits the permissions of the application process, leading to potential data theft, system modification, or complete system compromise.\nThis vulnerability affects versions 1.4.0 up to and including 1.7.2 and does not require pre-existing authentication if the codeMode utility is exposed to untrusted inputs."
}