How AI contributed: Incomplete remediationPublished Jun 18, 2026 in 
mervinpraison/praisonaiAll 19 findings in this repository
Summary The execute_code tool's subprocess sandbox advertises a three-layer defense (AST validation, text-pattern blocklist, restricted __builtins__). In sandbox mode (the default) only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining two CPython semantics: 1. Runtime string assembly. The AST validator (src/praisonai-agents/praisonaiagents/tools/python_tools.py:75) enumerates blocked dunder names against ast.Attribute.attr, ast.Call.func.id, and ast.Constant string-substring. Names assembled at runtime (e.g. "_"*2 + "class" + "_"*2) appear in the AST as multiple short ast.Constant nodes, none containing a blocked substring, so the static check passes. 2. C-level attribute access via format-spec. str.format / str.format_map resolve dotted field references through CPython's internal PyObject_GetAttr (do_string_format → get_field). This C path never consults the Python-level getattr binding. The sandbox's _safe_getattr wrapper (python_tools.py:221) is installed only as the getattr name in safe_builtins, so any C-level attribute access — including format-spec field resolution — sidesteps it. format/format_map are also absent from _SANDBOX_BLOCKED_CALLS (python_tools.py:56). Combined, this yields an arbitrary read primitive over every blocklisted attribute (__class__, __qualname__, __bases__, __base__, function __globals__, __dict__, …). Affected code File: Lines: Symbol: Role src/praisonai-agents/praisonaiagents/tools/python_tools.py: 39–54: _SANDBOX_BLOCKED_ATTRS: The blocklist the bypass renders unreachable src/praisonai-agents/praisonaiagents/tools/python_tools.py: 56–60: _SANDBOX_BLOCKED_CALLS: Missing entries: format, format_map src/praisonai-agents/praisonaiagents/tools/python_tools.py: 75–102: _validate_code_ast: Static check, blind to runtime string assembly src/praisonai-agents/praisonaiagents/tools/python_tools.py: 221–226: _safe_getattr: Wraps Python-level getattr only; C-level access bypasses src/praisonai-agents/praisonaiagents/tools/python_tools.py: 352: execute_code: Entry point; gated by @require_approval(risk_level="critical") Reproducer Observed: stdout = LEAK_CLASS=<class 'tuple'> / LEAK_QUAL2=tuple, success: true, no security error. Both __class__ (one hop) and __class__.__qualname__ (two hops) — all blocklisted — are read. Trust boundary The @require_approval(risk_level="critical") gate is bypassed when PRAISONAI_AUTO_APPROVE is set (verified: require_approval short-circuits on is_env_auto_approve()). That variable is set by the project's FULL_AUTO autonomy mode, the bots-CLI launchers, and the project's own issue-triage CI workflow — postures where the agent reaches execute_code with no human approval. The payload then arrives via any LLM-visible surface (user message, retrieved document, tool/web/MCP output) and the tool-call machinery passes it as the code argument. Relationship to GHSA-4mr5-g6f9-cfrh The code's own comment at python_tools.py:46 cites GHSA-4mr5-g6f9-cfrh, which added __self__ to the blocklist to stop C-builtins leaking builtins via func.__self__. This finding does not bypass that single entry — it bypasses the entire blocklist, because format-spec attribute resolution never consults the blocklist or _safe_getattr. "{0.__self__}".format(print) would leak __self__ regardless of the blocklist. Same defense surface, different mechanism; the GHSA-4mr5 fix does not mitigate this. Scope (read primitive only) This reports the read primitive. Turning the read into in-process execution requires a callable bridge; the obvious one (string.Formatter().get_field() returning the live object) is not directly reachable because import string is blocked at the AST layer (no ast.Import). Other bridges may exist; a full execution chain is not claimed here. If one is found, severity rises to ~8.8 (the subprocess has no seccomp/setrlimit/syscall filtering). Suggested fix 1. Add format, format_map to _SANDBOX_BLOCKED_CALLS (blocks the calls at the AST layer; cost: also blocks benign str.format). 2. Or replace str in safe_builtins with a subclass whose format/format_map reject dotted fields resolving to leading-underscore attributes (preserves benign formatting). 3. Or drop sandbox-mode's in-process security claim and document that real isolation requires external sandboxing (gVisor/firejail/container/microVM) — which matches what the subprocess provides today. The text-pattern blocklist present in the direct path (python_tools.py:487-502) is absent from the sandbox path; even if added, the runtime-assembly trick defeats it, so (1) or (2) is required. Reporter: Kai Aizen / SnailSploit — [email protected] — PGP on request. Coordinated disclosure; no public posting.
The execute_code sandbox validates submitted code with a static AST pass and a restricted builtins set, but in sandbox mode the text-pattern blocklist is skipped and names assembled at runtime never appear as blocked literals. str.format and str.format_map then resolve dotted field references through CPython's own attribute lookup, which bypasses the _safe_getattr wrapper that only rebinds the getattr name.
Case facts
CursorOnly the highlighted steps are this advisory. The first step is the earlier flaw the AI tried, and failed, to close.
Original flaw
Earlier advisory · CVE-2026-47392Sink: PraisonAI python_tools.py AST blocked-attribute and blocked-call validator
Originally written by AI (claude[bot])
This advisoryCVE-2026-57120 (GHSA-PV2J-RGHR-V5R9)
AI tried to fix this
The AI-assisted change was a real security patch, but it left the same advisory reachable.
Missed: Omitted format and format_map from blocked calls.
Fixed again
This is the patch that actually stops the same attack path.
AI-assisted fix: Cursor · MervinPraison
@@ -36,6 +36,30 @@ def _safe_getattr(obj, name, *default): return getattr(obj, name, *default) if default else getattr(obj, name) +_SANDBOX_BLOCKED_ATTRS = frozenset({+ '__subclasses__', '__bases__', '__mro__', '__globals__',+ '__code__', '__class__', '__dict__', '__builtins__',+ '__import__', '__loader__', '__spec__', '__init_subclass__',+ '__set_name__', '__reduce__', '__reduce_ex__',+ '__traceback__', '__qualname__', '__module__',+ '__wrapped__', '__closure__', '__annotations__',+ '__self__', # C builtins leak real builtins module (GHSA-4mr5-g6f9-cfrh)+ # Frame/code object introspection+ 'gi_frame', 'gi_code', 'cr_frame', 'cr_code',+ 'ag_frame', 'ag_code', 'tb_frame', 'tb_next',+ 'f_globals', 'f_locals', 'f_builtins', 'f_code',+ 'co_consts', 'co_names',+ '__getattribute__', '__getattr__', '__setattr__', '__delattr__',+ '__dir__', '__get__', '__set__', '__delete__',+})++_SANDBOX_BLOCKED_CALLS = frozenset({+ 'exec', 'eval', 'compile', '__import__',+ 'open', 'input', 'breakpoint',+ 'setattr', 'delattr', 'dir', 'vars',+})++ def _validate_code_ast(code: str): """Validate code using AST — catches attacks that bypass text checks. @@ -48,52 +72,33 @@ def _validate_code_ast(code: str): except SyntaxError: return None # let compile() handle syntax errors later - # Dangerous dunder attributes attackers use for sandbox escape- _blocked_attrs = frozenset({- '__subclasses__', '__bases__', '__mro__', '__globals__',- '__code__', '__class__', '__dict__', '__builtins__',- '__import__', '__loader__', '__spec__', '__init_subclass__',- '__set_name__', '__reduce__', '__reduce_ex__',- '__traceback__', '__qualname__', '__module__',- '__wrapped__', '__closure__', '__annotations__',- # Frame/code object introspection- 'gi_frame', 'gi_code', 'cr_frame', 'cr_code',- 'ag_frame', 'ag_code', 'tb_frame', 'tb_next',- 'f_globals', 'f_locals', 'f_builtins', 'f_code',- 'co_consts', 'co_names',- '__getattribute__', '__getattr__', '__setattr__', '__delattr__',- '__dir__', '__get__', '__set__', '__delete__',- })- for node in ast.walk(tree): # Block import statements if isinstance(node, (ast.Import, ast.ImportFrom)): return f"Import statements are not allowed" # Block attribute access to dangerous dunders if isinstance(node, ast.Attribute):- if node.attr in _blocked_attrs:+ if node.attr in _SANDBOX_BLOCKED_ATTRS: return ( f"Access to attribute '{node.attr}' is restricted" ) - # Block calls to dangerous builtins by name+ # Block calls to dangerous builtins (bare name or attribute access) if isinstance(node, ast.Call): func = node.func- if isinstance(func, ast.Name) and func.id in (- 'exec', 'eval', 'compile', '__import__',- 'open', 'input', 'breakpoint',- 'setattr', 'delattr', 'dir',- ):+ if isinstance(func, ast.Name) and func.id in _SANDBOX_BLOCKED_CALLS: return f"Call to '{func.id}' is not allowed"+ if isinstance(func, ast.Attribute) and func.attr in _SANDBOX_BLOCKED_CALLS:+ return f"Call to '{func.attr}' is not allowed" # Block dangerous constants (strings containing dunders) # Fallback for Python 3.7 ast.Str if isinstance(node, ast.Constant) and isinstance(node.value, str):- if any(attr in node.value for attr in _blocked_attrs):+ if any(attr in node.value for attr in _SANDBOX_BLOCKED_ATTRS): return f"String constant contains restricted attribute name" elif type(node).__name__ == 'Str':- if any(attr in getattr(node, 's', '') for attr in _blocked_attrs):+ if any(attr in getattr(node, 's', '') for attr in _SANDBOX_BLOCKED_ATTRS): return f"String constant contains restricted attribute name" @@ -21,6 +21,31 @@ logger = logging.getLogger(__name__) +def _resolve_cwd_yaml_path(file_path: str) -> "Path":+ """Resolve a YAML path strictly inside the current working directory."""+ from pathlib import Path++ if not isinstance(file_path, str) or not file_path:+ raise ValueError("file_path must be a non-empty string")+ if (+ "/" in file_path+ or "\\" in file_path+ or "\x00" in file_path+ or file_path.startswith(".")+ or file_path in ("..", ".")+ ):+ raise ValueError(f"invalid file_path: {file_path!r}")+ if not file_path.endswith((".yaml", ".yml")):+ raise ValueError("file_path must be a .yaml or .yml file")+ base = Path.cwd().resolve()+ candidate = (base / file_path).resolve()+ try:+ candidate.relative_to(base)+ except ValueError as exc:+ raise ValueError(f"invalid file_path: {file_path!r}") from exc+ return candidate++ def register_cli_tools() -> None: """Register CLI-based MCP tools.""" @@ -44,7 +69,8 @@ def workflow_validate(file_path: str) -> str: """Validate a workflow YAML file.""" try: import yaml- with open(file_path, 'r') as f:+ yaml_path = _resolve_cwd_yaml_path(file_path)+ with open(yaml_path, 'r') as f: config = yaml.safe_load(f) required = ["framework", "topic"]@@ -64,9 +90,10 @@ def workflow_validate(file_path: str) -> str: def workflow_show(file_path: str) -> str: """Show workflow configuration.""" try:- with open(file_path, 'r') as f:- content = f.read()- return content+ yaml_path = _resolve_cwd_yaml_path(file_path)+ return yaml_path.read_text()+ except ValueError as e:+ return f"Error: {e}" except FileNotFoundError: return f"File not found: {file_path}" except Exception as e:@@ -417,7 +444,8 @@ def deploy_validate(config_path: str = "deploy.yaml") -> str: """Validate deployment configuration.""" try: import yaml- with open(config_path, 'r') as f:+ yaml_path = _resolve_cwd_yaml_path(config_path)+ with open(yaml_path, 'r') as f: config = yaml.safe_load(f) required = ["name", "type"]@@ -11,6 +11,8 @@ """ import logging+import ipaddress+import socket from typing import List, Dict, Union, Optional, Any from importlib import util import json@@ -20,6 +22,48 @@ import hashlib import time ++def _host_is_blocked(hostname: str) -> bool:+ """Return True when hostname resolves to loopback/private/internal targets."""+ if not hostname:+ return True+ host = hostname.lower().rstrip(".")+ if host in ("localhost", "0.0.0.0", "::1") or host.endswith(".localhost"):+ return True+ if host in ("169.254.169.254", "metadata.google.internal"):+ return True+ if any(host.endswith(suffix) for suffix in (".local", ".internal", ".localdomain")):+ return True++ def _ip_blocked(ip: ipaddress._BaseAddress) -> bool:+ return bool(+ ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local+ )++ if host.isdigit():+ try:+ return _ip_blocked(ipaddress.ip_address(int(host)))+ except (ValueError, OverflowError):+ return True++ if host.startswith("0x"):+ try:+ return _ip_blocked(ipaddress.ip_address(int(host, 16)))+ except (ValueError, OverflowError):+ return True++ try:+ return _ip_blocked(ipaddress.ip_address(host))+ except ValueError:+ pass++ try:+ return _ip_blocked(ipaddress.ip_address(socket.inet_aton(host)))+ except OSError:+ pass++ return False+ class SpiderTools: """Tools for web scraping and crawling.""" @@ -59,31 +103,9 @@ def _validate_url(self, url: str) -> bool: if not parsed.hostname: return False - # Reject local/internal addresses- hostname = parsed.hostname.lower()- - # Block localhost and loopback- if hostname in ['localhost', '127.0.0.1', '0.0.0.0', '::1']:- return False- - # Block private IP ranges- import ipaddress- try:- ip = ipaddress.ip_address(hostname)- if ip.is_private or ip.is_reserved or ip.is_loopback or ip.is_link_local:- return False- except ValueError:- # Not an IP address, continue with domain validation- pass- - # Block common internal domains- if any(hostname.endswith(domain) for domain in ['.local', '.internal', '.localdomain']):- return False- - # Block metadata service endpoints- if hostname in ['169.254.169.254', 'metadata.google.internal']:+ if _host_is_blocked(parsed.hostname): return False- + return True@@ -0,0 +1,24 @@+"""Path validation for async jobs agent file references."""++from __future__ import annotations++import os+from typing import Optional+++def validate_agent_file_path(agent_file: Optional[str]) -> Optional[str]:+ """Restrict agent_file to PRAISONAI_JOBS_AGENT_ROOT when that env var is set."""+ if not agent_file:+ return agent_file++ root = os.environ.get("PRAISONAI_JOBS_AGENT_ROOT")+ if not root:+ return agent_file++ resolved = os.path.realpath(os.path.abspath(agent_file))+ root_resolved = os.path.realpath(os.path.abspath(root))+ if resolved != root_resolved and not resolved.startswith(root_resolved + os.sep):+ raise ValueError(+ f"agent_file must be within PRAISONAI_JOBS_AGENT_ROOT ({root_resolved})"+ )+ return agent_file@@ -194,9 +194,13 @@ def reset_yaml_approved_tools(self, token: contextvars.Token) -> None: def is_yaml_approved(self, tool_name: str) -> bool: try:- return tool_name in self._yaml_approved_tools.get()+ if tool_name not in self._yaml_approved_tools.get():+ return False except LookupError: return False+ if self.get_risk_level(tool_name) == "critical":+ return False+ return True # ── Env-var check ──────────────────────────────────────────────────── @@ -23,6 +23,7 @@ ) from .store import JobStore from .executor import JobExecutor+from .path_validation import validate_agent_file_path logger = logging.getLogger(__name__) @@ -77,9 +78,14 @@ async def submit_job( ) # Create new job+ try:+ agent_file = validate_agent_file_path(body.agent_file)+ except ValueError as exc:+ raise HTTPException(status_code=400, detail=str(exc)) from exc+ job = Job( prompt=body.prompt,- agent_file=body.agent_file,+ agent_file=agent_file, agent_yaml=body.agent_yaml, framework=body.framework or "praisonai", config=body.config or {},AI-assisted change 44c6ad687cb10ed23d894bca7efdffaa27585e91cc21209d8834552e4a1ded0e · Fix 992186271771265e20730b85237dc17a443332f1ae4acd0a8f8e36c79ec3bec9