PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by constructing the child_process module name dynamically. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials, and execute operating-system commands with the PraisonAI process privileges.
This issue is fixed in version 1.7.2.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/MervinPraison/PraisonAI/commit/709a0387853709a5e2f2c34680fa6…
security-advisories@github.com
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.60
security-advisories@github.com
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p69m-4f92-2…
security-advisories@github.com