npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp) - ATR-2026-01953 (52c34d08-aa10-59f8-9984-35f8be3cb9b6)
Detects GHSA-vmmj-pfw7-fjwp (CRITICAL): praisonai npm >= 1.4.0 <= 1.7.1 exposes a codeMode builtin tool (src/tools/builtins/code-mode.ts) that claims sandbox:true but executes the supplied code in the HOST V8 context via new Function('sandbox', 'with (sandbox) { ' + code + ' }'). Setting process/require to undefined and blocklisting require('fs') is bypassed by recovering the real Function constructor through the prototype chain. This rule keys on the distinctive breakout tokens: .constructor.constructor('return process')() and process.mainModule.require, which let attacker code reach fs / child_process for host RCE. Fixed in 1.7.2.