Description

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by constructing the child_process module name dynamically. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials, and execute operating-system commands with the PraisonAI process privileges. This issue is fixed in version 1.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-15T11:17:11.617Z",
  "pubdate": "2026-09-15T11:17:11.617Z",
  "executiveSummary": "PraisonAI versions prior to 1.7.2 contain a critical Arbitrary Code Execution (ACE) vulnerability located within the codeMode tool. The vulnerability stems from the unsafe execution of model-generated JavaScript code within a sandboxed environment that fails to effectively isolate the host process.\nThe flaw allows an attacker capable of influencing the 'code' argument to bypass existing security filters and access the underlying operating system. By leveraging techniques to break out of the sandbox, an attacker can execute arbitrary commands with the privileges of the PraisonAI process. This leads to severe security implications, including unauthorized file system access, exfiltration of sensitive environment credentials, and potential full system compromise. The vulnerability is triggered by the improper use of JavaScript execution primitives, specifically 'new Function()' and the 'with' statement, which are susceptible to context breakout attacks. Users are strongly advised to update to version 1.7.2 or later to remediate this vulnerability.",
  "technicalDetails": "The vulnerability resides in the 'codeMode' tool implementation within the file 'src/praisonai-ts/src/tools/builtins/code-mode.ts'. The application attempts to execute model-generated JavaScript code by utilizing 'new Function()' in conjunction with a 'with(sandbox)' statement to constrain the execution context.\nThe root cause is a flawed security mechanism relying on a regular-expression-based blocklist to prevent access to sensitive modules or objects. This control is insufficient because the JavaScript execution context is not properly hardened. An attacker can bypass these restrictions by invoking 'Function('return this')()' to escape the restricted sandbox scope and recover the global object. Once the global scope is accessed, the attacker is no longer constrained by the sandboxing wrapper.\nThe attack flow proceeds as follows: First, the attacker provides a malicious payload within the 'code' argument. Second, the payload utilizes the identified breakout technique to move from the restricted 'with' block into the global object context. Third, the attacker utilizes dynamic property access or string concatenation (e.g., constructing the 'child_process' module name dynamically) to circumvent the static regex blocklist that seeks to prevent the loading of dangerous Node.js built-in modules.\nBy successfully importing 'child_process', the attacker gains the ability to execute arbitrary system commands via 'exec' or 'spawn' methods. Because the code executes with the same privileges as the PraisonAI host process, the attacker can perform unauthorized operations such as reading sensitive configuration files, modifying the host environment, or exfiltrating environment variables containing API keys and authentication secrets. The vulnerability does not require authentication to the underlying operating system, as the exploit is facilitated through the input provided to the PraisonAI interface. The lack of robust process isolation means that the sandbox is purely logical and easily circumvented by standard JavaScript prototype manipulation techniques."
}