GHSA-vmmj-pfw7-fjwp: npm PraisonAI codeMode sandbox escape via Function constructor

Summary The published npm package praisonai exports a TypeScript built-in tool named codeMode. The package describes this tool as executing code in a sandboxed environment, marks its capability as sandbox: true, and registers it through the public tools facade. The implementation does not create an isolation boundary. It applies a small regular-expression blocklist, sets process and require to undefined inside a plain JavaScript object, and then executes attacker-controlled code with the host process new Function constructor: const fn = new Function('sandbox', with (sandbox) { ${code} }); const result = fn(sandbox); Because this runs in the host V8 context, code inside codeMode can use the JavaScript prototype chain to recover the real Function constructor: ({}).constructor.constructor('return process')() From a normal CommonJS application script, the recovered process object exposes process.mainModule.require. That bypasses the explicit require('fs') and require('child_process') controls and allows host filesystem access and subprocess execution from code that was supposed to be sandboxed. Technical Details Current-head source says codeMode is a built-in package tool and explicitly advertises a sandbox boundary: src/praisonai-ts/src/tools/builtins/code-mode.ts 13: description: 'Execute code that can import and use other tools in a sandboxed environment', 24: capabilities: { 25: sandbox: true, 26: code: true, 28: packageName: 'praisonai', 85: description: 'Execute code in a sandboxed environment with access to imported tools. Write files, run code, and get results.', The same file implements security as a blocklist of exact source-code patterns: src/praisonai-ts/src/tools/builtins/code-mode.ts 108: const blockedPatterns = [ 109: /require\s*\(\s*['"]child_process['"]\s*\)/, 110: /require\s*\(\s*['"]fs['"]\s*\)/, 111: /import\s+.*from\s+['"]child_process['"]/, 112: /process\.exit/, 113: /eval\s*\(/, It then tries to hide dangerous globals by shadowing name