npm PraisonAI codeMode sandbox escape via Function constructor
Date: 2026-06
Affected: npm/praisonai
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-184
CWE-693
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

## Summary The published npm package `praisonai` exports a TypeScript built-in tool named `codeMode`. The package describes this tool as executing code in a sandboxed environment, marks its capability as `sandbox: true`, and registers it through the public tools facade. The implementation does not create an isolation boundary. It applies a small regular-expression blocklist, sets `process` and `require` to `undefined` inside a plain JavaScript object, and then executes attacker-controlled code with the host process `new Function` constructor: ```text const fn = new Function('sandbox', `with (sandbox) { ${code} }`); const result = fn(sandbox); ``` Because this runs in the host V8 context, code inside `codeMode` can use the JavaScript prototype chain to recover the real `Function` constructor: ```text ({}).constructor.constructor('return process')() ``` From a normal CommonJS application script, the recovered `process` object exposes `process.mainModule.require`. That bypasses the explicit `require('fs')` and `require('child_process')` controls and allows host filesystem access and subprocess execution from code that was supposed to be sandboxed. ## Technical Details Current-head source says `codeMode` is a built-in package tool and explicitly advertises a sandbox boundary: ```text src/praisonai-ts/src/tools/builtins/code-mode.ts 13: description: 'Execute code that can import and use other tools in a sandboxed environment', 24: capabilities: { 25: sandbox: true


Mitigations:

Architectural layers (MAESTRO):