Executive brief
The PraisonAI package for Node.js contains a tool called 'codeMode' that is intended to run code in a secure, isolated sandbox. However, this sandbox can be easily bypassed, allowing an attacker to run malicious commands directly on the host server. This could lead to the theft of sensitive data like API keys, unauthorized access to files, or full control over the system running the software.
Technical details
The 'codeMode' tool in the praisonai npm package attempts to sandbox JavaScript execution using a combination of regular-expression blocklists and variable shadowing (setting 'process' and 'require' to undefined) within a 'new Function' constructor. This approach fails to create a true security boundary because it runs within the host V8 context. An attacker can use the JavaScript prototype chain (e.g., via '({}).constructor.constructor') to recover the real 'Function' constructor and access the host 'process' object. This allows the attacker to bypass 'require' restrictions, access the filesystem, and execute arbitrary subprocesses. The vulnerability is reachable whenever untrusted input or LLM-generated code is passed to the 'codeMode' tool.
Affected products
- MervinPraison praisonai >= 1.4.0, <= 1.7.1
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory: GitHub Advisory GHSA-vmmj-pfw7-fjwp published
- 1.7.2: patched