MervinPraison PraisonAI network isolation bypass in SandboxExecutor

Executive brief

PraisonAI is a tool used to execute AI-generated code and commands in a controlled environment. A vulnerability in its "network-isolated" mode means that commands intended to be blocked from the internet can still access the network if they use standard communication methods that ignore proxy settings. This could allow an attacker to steal sensitive data or access internal company services that were supposed to be protected by the sandbox.

Technical details

The `SandboxExecutor` in the `praisonai` npm package implements its `network-isolated` mode solely by injecting proxy environment variables (e.g., `http_proxy=http://localhost:0`) into the child process. It lacks OS-level enforcement such as network namespaces, firewall rules, or socket filters. Consequently, any network client or library that does not explicitly honor these environment variables (such as direct socket calls or certain HTTP libraries) can bypass the intended isolation and reach the host network or external internet. This allows for data exfiltration or unauthorized access to internal services from within the sandbox. The issue is addressed in version 1.7.2.

Affected products

• MervinPraison praisonai >= 1.2.3, <= 1.7.1

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory
• 1.7.2: patched

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D