Executive brief
PraisonAI is an agent framework for Node.js that provides a code execution tool called codeMode, marketed as executing code in a sandboxed environment. However, the sandbox implementation is ineffective—attackers can use JavaScript prototype chain manipulation to escape the intended restrictions and gain access to the host process's filesystem and subprocess execution capabilities, allowing arbitrary command execution on systems running PraisonAI.
Technical details
The codeMode tool attempts to sandbox untrusted code by blocking direct require() calls to fs and child_process, setting process and require to undefined in a plain JavaScript object, and executing code within a with (sandbox) block using the host process's new Function constructor. However, this design fundamentally fails to create an isolation boundary. An attacker can bypass the intended restrictions by using the JavaScript prototype chain to recover the real Function constructor: ({}).constructor.constructor('return process')(). From there, process.mainModule.require exposes access to arbitrary modules, bypassing the regex-based blocklist and enabling both filesystem access and subprocess execution. The vulnerability affects versions 1.4.0 through 1.7.1; version 1.7.2 and later contain a fix. The attack requires authenticated use of the codeMode tool but can be chained with other LLM-driven code generation workflows where an attacker controls the input code.
Affected products
- npm PraisonAI >=1.4.0, <=1.7.1
Timeline
- 2026-06-18: disclosed: GHSA-vmmj-pfw7-fjwp published
- 2026-06-18: patched: Version 1.7.2 and later patched