PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist plus shadowed process and require properties. Code can use ({}).constructor.constructor to recover the real Function constructor, obtain process and process.mainModule.require, and reach host filesystem and subprocess APIs despite the advertised sandbox. Atta

A critical sandbox escape vulnerability exists in PraisonAI, a multi-agent teams system, affecting versions 1.4.0 through 1.7.2. The vulnerability resides in the codeMode component which executes untrusted JavaScript using new Function() inside a with(sandbox) block. The sandbox relies on a small blocklist and shadowed process/require properties, which are insufficient protections. Attackers can use the prototype chain trick ({}).constructor.constructor to recover the real Function constructor, bypassing the sandbox entirely. This allows access to process and process.mainModule.require, enabling attackers to reach host filesystem and subprocess APIs. Exploitation can lead to reading secrets, modifying files, executing arbitrary commands, or exhausting host process resources. The vulnerability has been patched in version 1.7.2.