PraisonAI CodeAgent Unsandboxed Code Execution via Prompt Injection

Technical Analysis

The vulnerability lies in CodeAgent._execute_python(), which takes code produced by the LLM and executes it directly (likely via exec/eval or subprocess) without static analysis, import allow/deny lists, or containment such as a restricted interpreter, gVisor, or seccomp sandbox. The entry point is any untrusted input that reaches the LLM's context—user prompts, retrieved documents, tool outputs, or other agent messages—enabling classic prompt injection to steer the model into generating malicious Python (e.g., os.system, subprocess, socket, or reading environment variables and cloud credential files). Because the generated code runs with the same privileges as the agent process, the attacker crosses the boundary from 'text influencing an LLM' to 'arbitrary code execution on the host,' gaining access to all environment secrets, filesystem contents, and network reachability. This is a textbook combination of prompt injection (model layer) escalating into a tool-layer execution primitive with no isolation, satisfying CVSS 10.0 due to complete confidentiality/integrity/availability impact with no required privileges.

Affected Systems

PraisonAI

Detection Signatures

• Outbound network calls or environment variable reads immediately following LLM code-generation steps in CodeAgent execution logs
• Unexpected subprocess/os/sys/socket import usage in generated code artifacts
• CodeAgent execution transcripts containing code that accesses os.environ, .env files, or cloud metadata endpoints (e.g., 169.254.169.254)
• Anomalous child processes spawned by the PraisonAI process
• Prompt/context content containing instructions like 'ignore previous instructions and run the following code' or embedded code blocks in retrieved documents/tool outputs

Remediation Steps

1. 1

   Upgrade PraisonAI

   Update to PraisonAI 1.6.78 or later, which should include the patched execution path; verify the fix actually enforces sandboxing before deploying.

2. 2

   Sandbox all code execution

   Run CodeAgent-generated code in an isolated, resource-limited sandbox (gVisor, Firecracker microVM, restricted container with no host mounts, dropped capabilities, and network egress denial by default).

3. 3

   Enforce AST/static validation

   Parse generated code with AST checks to block dangerous imports (os, subprocess, socket, ctypes) and disallow dynamic exec/eval constructs before execution.

4. 4

   Remove secrets from agent execution environment

   Do not expose long-lived credentials, API keys, or cloud IAM roles to the process running CodeAgent; use short-lived, scoped tokens injected only when strictly necessary.

5. 5

   Harden against prompt injection

   Apply input/output filtering, content provenance tagging, and instruction-hierarchy enforcement to reduce the ability of untrusted text to alter code-generation behavior.

6. 6

   Monitor and alert

   Add runtime monitoring for anomalous subprocess creation, outbound connections, and file access originating from the agent execution sandbox.