GHSA-gqmf-56h7-rrpf: npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

Summary The published npm package praisonai exports a TypeScript SandboxExecutor with a network-isolated mode. The CLI lists that mode as: network-isolated No network access (proxy blocked) The implementation does not create a network namespace, firewall rule, socket filter, or proxy-enforced execution boundary. It only injects proxy environment variables into the child process: http_proxy: 'http://localhost:0', https_proxy: 'http://localhost:0', HTTP_PROXY: 'http://localhost:0', HTTPS_PROXY: 'http://localhost:0', no_proxy: '', NO_PROXY: '' Clients that do not explicitly honor those proxy variables continue to use the host network stack. A local-only PoV shows that, inside mode: "network-isolated", a proxy-aware Node invocation is stopped, while a plain Node HTTP client reaches a loopback HTTP server from the same sandboxed command environment. This is a network-isolation protection failure in an exported npm API and CLI mode. It is not a generic claim that every PraisonAI sandbox backend is affected. Technical Details src/praisonai-ts/src/cli/features/sandbox-executor.ts declares the mode: export type SandboxMode = 'disabled' | 'basic' | 'strict' | 'network-isolated'; SandboxExecutor.spawn() starts the command through the host shell and passes only the environment returned by buildEnv(): const proc = spawn('sh', ['-c', command], { cwd: this.config.cwd, env, timeout: this.config.timeout, stdio: ['pipe', 'pipe', 'pipe'] }); For network-isolated, buildEnv() does not apply an OS-level network restriction. It only sets proxy variables: case 'network-isolated': // No network access (requires additional OS-level setup) return { ...baseEnv, http_proxy: 'http://localhost:0', https_proxy: 'http://localhost:0', HTTP_PROXY: 'http://localhost:0', HTTPS_PROXY: 'http://localhost:0', no_proxy: '', NO_PROXY: '' }; The CLI mode listing presents this as no network access: 'network-isolated': 'No network access (proxy blocked)' That creates a false boundary. Proxy vari