MervinPraison PraisonAI remote code execution in codeMode tool

Executive brief

PraisonAI is an AI agent framework that includes a tool for executing code. A security flaw in this tool allows an attacker to bypass safety restrictions and execute arbitrary commands on the underlying server. This could lead to full system takeover, theft of sensitive data like API keys, and unauthorized access to the corporate network.

Technical details

The `codeMode` tool in `praisonai-ts` uses `new Function()` with a `with(sandbox)` pattern to execute LLM-generated code. This implementation is vulnerable to a sandbox escape because the `with` statement does not prevent access to the global object. An attacker can use `Function('return this')()` to recover the global object and then use string concatenation (e.g., `require('child_' + 'process')`) to evade the regex-based blocklist. This allows for full arbitrary code execution (RCE) on the host system. The vulnerability is fixed in version 1.7.2 by improving isolation.

Affected products

• MervinPraison praisonai <= 1.7.1

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory
• 2026-06-18: patched: Fixed in version 1.7.2

References

• https://api.github.com/users/sondt99
• https://github.com/sondt99
• https://api.github.com/users/sondt99/gists%7B/gist_id%7D
• https://api.github.com/users/sondt99/repos
• https://avatars.githubusercontent.com/u/87920408?v=4
• https://api.github.com/users/sondt99/events%7B/privacy%7D