GitHub Security Advisory: GHSA-qf73-2hrx-xprp
Package: praisonaiagents (PIP)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-657: Violation of Secure Design Principles, CWE-693: Protection Mechanism Failure
Vulnerable versions: <= 1.5.114
Patched in: 1.5.115

Summary: PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

Details:
## Summary

`execute_code()` in `praisonaiagents.tools.python_tools` defaults to
`sandbox_mode="sandbox"`, which runs user code in a subprocess wrapped with a
restricted `__builtins__` dict and an AST-based blocklist. The AST blocklist
embedded inside the subprocess wrapper (`blocked_attrs`, line 143 of
`python_tools.py`) contains only 11 attribute names — a strict subset of the 30+
names blocked in the direct-execution path. The four attributes that form a
frame-traversal chain out of the sandbox are all absent from the subprocess list:

| Attribute | In subprocess `blocked_attrs` | In direct-mode `_blocked_attrs` |
|---|---|---|
| `__traceback__` | **NO** | YES |
| `tb_frame` | **NO** | YES |
| `f_back` | **NO** | YES |
| `f_builtins` | **NO** | YES |

Chaining these attributes through a caught exception exposes the real Python
`builtins` dict of the subprocess wrapper frame, from which `exec` can be
retrieved and called under a non-blocked variable name — bypassing every
remaining security layer.

**Tested and confirmed on praisonaiagents 1.5.113 (latest), Python 3.10.**

---

## Severity

**CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — 9.9 Critical**

| Vector | Value | Rationale |
|---|---|---|
| AV:N | Network | `execute_code` is a designated agent tool; user/LLM-supplied code reaches it over the network in all standard deployments |
| AC:L | Low | No race conditions or special configuration required |
| PR:L | Low | Requires ability to submit code through an agent (typical end-user privilege) |
| UI:N | None | No victim interaction |
| S:C | Changed | Escapes subprocess sandbox into full host process context |
| C:H | High | Arbitrary file read, environment variable access, credential exfiltration |
| I:H | High | Arbitrary file write, arbitrary code execution on host |
| A:H | High | Can terminate processes, exhaust resources |

---

## Affected

- **Package**: `praisonaiagents` (PyPI)
- **Affected versions**: all versions shipping `sandbox_mode="sandbox"` (default since introduction) through **1.5.113**
- **Patched versions**: none at time of report
- **File**: `praisonaiagents/tools/python_tools.py`

---

## Root Cause

### Two separate `blocked_attrs` sets — one much weaker than the other

`_validate_code_ast()` (line 39, used by direct mode) blocks 30+ attributes:

```python
# python_tools.py line 52 — direct mode (FULL list, correctly includes frame attrs)
_blocked_attrs = frozenset({
    '__subclasses__', '__bases__', '__mro__', '__globals__',
    '__code__', '__class__', '__dict__', '__builtins__',
    '__import__', '__loader__', '__spec__', '__init_subclass__',
    '__set_name__', '__reduce__', '__reduce_ex__',
    '__traceback__', '__qualname__', '__module__',   # ← present here
    '__wrapped__', '__closure__', '__annotations__',
    'gi_frame', 'gi_code', 'cr_frame', 'cr_code',
    'ag_frame', 'ag_code', 'tb_frame', 'tb_next',    # ← present here
    'f_globals', 'f_locals', 'f_builtins', 'f_code', # ← present here
    'co_con