Executive brief
PraisonAI's codeMode tool allows AI agents to execute code for task automation. An attacker can craft malicious prompts that break out of the sandbox isolation and execute arbitrary commands on the server with full system access, including file theft, credential exfiltration, and installing backdoors.
Technical details
The vulnerability is an unsafe code execution in the codeMode tool (src/praisonai-ts/src/tools/builtins/code-mode.ts), which uses JavaScript's new Function() with a with(sandbox) pattern to execute LLM-generated code. The with statement does not isolate the scope—attackers can bypass it via Function('return this')() to recover the global object and access require(), then evade the regex blocklist by breaking apart module names via string concatenation (e.g., require('child_' + 'process')). The blocklist patterns are incomplete and do not cover Function constructors or prototype access. An attacker who can influence prompts to the AI agent achieves full RCE as the process user. The fix requires replacing the with(sandbox) + blocklist pattern with proper VM isolation (vm.createContext or isolated-vm) or subprocess execution with resource limits.
Affected products
- Mervin Praison PraisonAI <=1.7.1
Timeline
- 2026-06-18: disclosed
- 2026-06-18: patched: Patch available in version 1.7.2 or later