npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)
PraisonAI's codeMode tool advertises itself as a sandbox but actually runs submitted code directly in the same JavaScript engine as the host application. Attackers who can submit code to this tool can climb the prototype chain to recover the real Function constructor and break out to full system access.
How the attack works
An attacker sends code to the codeMode builtin tool, which claims sandbox:true but really wraps input in a plain `new Function` call executed in the host V8 context. The tool tries to block escape by setting process and require to undefined and blocklisting fs, but the attacker recovers a working Function constructor via `.constructor.constructor('return process')()`, walking the prototype chain instead of using the blocked names directly. From there, `process.mainModule.require` lets the attacker load Node's fs or child_process modules. This gives the attacker the ability to read/write files or run shell commands on the host, not just inside any sandbox.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7e5c4f51-f39f-47be-b554-29eee5202f43
- Severity
- Critical
Why it matters
An attacker who can reach the codeMode tool gets full code execution on the host running PraisonAI, meaning file system access, command execution, and potential compromise of anything else reachable from that host.
What you can do
- →Upgrade praisonai to 1.7.2 or later, where this is fixed.
- →Until upgraded, disable or restrict access to the codeMode builtin tool entirely.
- →Do not treat codeMode's sandbox:true flag as a real security boundary; run any untrusted code execution feature in an isolated process or container instead.
- →Audit logs for code submissions containing `.constructor.constructor` or `process.mainModule.require` patterns to catch exploitation attempts.
Known benign look-alikes
- Security advisory or blog text quoting the GHSA-vmmj-pfw7-fjwp PoC for documentation, without it being executed as codeMode input.
- Legitimate code that references `constructor` once (e.g. `obj.constructor.name`) or uses a single `new Function(...)` for templating, without the double-constructor `return process` breakout.
- Node app legitimately reading `process.env` or `process.mainModule` in trusted host code that is not submitted to a sandboxed codeMode/eval tool.