1 matches found
PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
Summary The codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts uses new Function with a withsandbox pattern to execute LLM-generated code. The blocklist-based "sandbox" can be trivially bypassed via Function'return this' to recover the global object, followed by global.require with...
6.5AI score
SaveExploits0References2Affected Software1
20