CVE-2026-57144

PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.

PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.

Summary

praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False.

On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config).

That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False.

Technical Details

SandboxConfig.native() creates a restricted native policy and records caller-provided writable paths plus the requested network posture:

return cls(
    sandbox_type="native",
    working_dir=os.getcwd(),
    security_policy=SecurityPolicy(
        allow_network=network,
        allow_file_write=True,
        allow_subprocess=True,
        allowed_paths=resolved_paths,
    ),
    metadata={"writable_paths": resolved_paths, "network": network},
)

SandlockSandbox builds the intended kernel policy with Landlock-backed filesystem allowlisting and network denial:

policy = Policy(
    fs_readable=allowed_read_paths,
    fs_writable=allowed_write_paths,
    net_allow_hosts=[] if not limits.network_enabled else None,
    max_memory=f"{limits.memory_mb}M",
    max_processes=limits.max_processes,
    max_open_files=limits.max_open_files,
)

However, both execution paths fail open when Sandlock is unavailable:

if not self.is_available:
    logger.warning("Sandlock not available, falling back to subprocess")
    from .subprocess import SubprocessSandbox
    fallback = SubprocessSandbox(self.config)
    return await fallback.execute(code, language, limits, env, working_dir)

SubprocessSandbox.execute() writes the code to a temp file and runs python with a minimal environment and POSIX rlimits. It does not install a filesystem sandbox, network namespace, syscall filter, chroot, Landlock policy, or path allowlist for the code execution path. The safe_sandbox_path() checks only protect the read_file(), write_file(), and list_files() helper methods.

Why This Is Not Intended Behavior

The report is not based only on a trust-model disagreement. The code and docs define a concrete boundary:

• PraisonAI's Sandlock README says the backend provides kernel-level filesystem allowlisting, network isolation, seccomp filtering, and blocks /etc/passwd, SSH keys, AWS credentials, and unauthorized connections.
• The security demo creates SandboxConfig.native(writable_paths=["./safe_workspace"], network=False) and labels file and network access as blocked operations.
• The upstream sandlock package requires Linux with a compatible Landlock ABI and documents a fail-closed default for missing required protections unless the caller explicitly opts into degraded protection.
• PraisonAI's own current security page recommends sandboxed execution and says path traversal protection is enabled by default for local sandbox backends.

The bug is the silent fallback from an unavailable kernel-enforced boundary to plain subprocess execution without preserving the configured native policy.

PoV

Run from a PraisonAI source checkout:

python3 poc/pov_poc.py \
  --repo /path/to/PraisonAI

The PoV:

1. injects a fake sandlock module that imports successfully but reports no usable Landlock support;
2. configures SandboxConfig.native(writable_paths=[tenant_a], network=False);
3. creates tenant-b-secret.txt outside the configured path;
4. starts a localhost TCP listener;
5. executes code through SandlockSandbox.execute().

Observed result on v4.6.58:

{
  "child_output": {
    "network_reply": "local-ok",
   …

PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.

Summary

praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False.

On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config).

That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False.

Technical Details

SandboxConfig.native() creates a restricted native policy and records caller-provided writable paths plus the requested network posture:

return cls(
    sandbox_type="native",
    working_dir=os.getcwd(),
    security_policy=SecurityPolicy(
        allow_network=network,
        allow_file_write=True,
        allow_subprocess=True,
        allowed_paths=resolved_paths,
    ),
    metadata={"writable_paths": resolved_paths, "network": network},
)

SandlockSandbox builds the intended kernel policy with Landlock-backed filesystem allowlisting and network denial:

policy = Policy(
    fs_readable=allowed_read_paths,
    fs_writable=allowed_write_paths,
    net_allow_hosts=[] if not limits.network_enabled else None,
    max_memory=f"{limits.memory_mb}M",
    max_processes=limits.max_processes,
    max_open_files=limits.max_open_files,
)

However, both execution paths fail open when Sandlock is unavailable:

if not self.is_available:
    logger.warning("Sandlock not available, falling back to subprocess")
    from .subprocess import SubprocessSandbox
    fallback = SubprocessSandbox(self.config)
    return await fallback.execute(code, language, limits, env, working_dir)

SubprocessSandbox.execute() writes the code to a temp file and runs python with a minimal environment and POSIX rlimits. It does not install a filesystem sandbox, network namespace, syscall filter, chroot, Landlock policy, or path allowlist for the code execution path. The safe_sandbox_path() checks only protect the read_file(), write_file(), and list_files() helper methods.

Why This Is Not Intended Behavior

The report is not based only on a trust-model disagreement. The code and docs define a concrete boundary:

• PraisonAI's Sandlock README says the backend provides kernel-level filesystem allowlisting, network isolation, seccomp filtering, and blocks /etc/passwd, SSH keys, AWS credentials, and unauthorized connections.
• The security demo creates SandboxConfig.native(writable_paths=["./safe_workspace"], network=False) and labels file and network access as blocked operations.
• The upstream sandlock package requires Linux with a compatible Landlock ABI and documents a fail-closed default for missing required protections unless the caller explicitly opts into degraded protection.
• PraisonAI's own current security page recommends sandboxed execution and says path traversal protection is enabled by default for local sandbox backends.

The bug is the silent fallback from an unavailable kernel-enforced boundary to plain subprocess execution without preserving the configured native policy.

PoV

Run from a PraisonAI source checkout:

python3 poc/pov_poc.py \
  --repo /path/to/PraisonAI

The PoV:

1. injects a fake sandlock module that imports successfully but reports no usable Landlock support;
2. configures SandboxConfig.native(writable_paths=[tenant_a], network=False);
3. creates tenant-b-secret.txt outside the configured path;
4. starts a localhost TCP listener;
5. executes code through SandlockSandbox.execute().

Observed result on v4.6.58:

{
  "child_output": {
    "network_reply": "local-ok",
   …

Summary

praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False.

On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config).

That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False.

Technical Details

SandboxConfig.native() creates a restricted native policy and records caller-provided writable paths plus the requested network posture:

return cls(
    sandbox_type="native",
    working_dir=os.getcwd(),
    security_policy=SecurityPolicy(
        allow_network=network,
        allow_file_write=True,
        allow_subprocess=True,
        allowed_paths=resolved_paths,
    ),
    metadata={"writable_paths": resolved_paths, "network": network},
)

SandlockSandbox builds the intended kernel policy with Landlock-backed filesystem allowlisting and network denial:

policy = Policy(
    fs_readable=allowed_read_paths,
    fs_writable=allowed_write_paths,
    net_allow_hosts=[] if not limits.network_enabled else None,
    max_memory=f"{limits.memory_mb}M",
    max_processes=limits.max_processes,
    max_open_files=limits.max_open_files,
)

However, both execution paths fail open when Sandlock is unavailable:

if not self.is_available:
    logger.warning("Sandlock not available, falling back to subprocess")
    from .subprocess import SubprocessSandbox
    fallback = SubprocessSandbox(self.config)
    return await fallback.execute(code, language, limits, env, working_dir)

SubprocessSandbox.execute() writes the code to a temp file and runs python with a minimal environment and POSIX rlimits. It does not install a filesystem sandbox, network namespace, syscall filter, chroot, Landlock policy, or path allowlist for the code execution path. The safe_sandbox_path() checks only protect the read_file(), write_file(), and list_files() helper methods.

Why This Is Not Intended Behavior

The report is not based only on a trust-model disagreement. The code and docs define a concrete boundary:

• PraisonAI's Sandlock README says the backend provides kernel-level filesystem allowlisting, network isolation, seccomp filtering, and blocks /etc/passwd, SSH keys, AWS credentials, and unauthorized connections.
• The security demo creates SandboxConfig.native(writable_paths=["./safe_workspace"], network=False) and labels file and network access as blocked operations.
• The upstream sandlock package requires Linux with a compatible Landlock ABI and documents a fail-closed default for missing required protections unless the caller explicitly opts into degraded protection.
• PraisonAI's own current security page recommends sandboxed execution and says path traversal protection is enabled by default for local sandbox backends.

The bug is the silent fallback from an unavailable kernel-enforced boundary to plain subprocess execution without preserving the configured native policy.

PoV

Run from a PraisonAI source checkout:

python3 poc/pov_poc.py \
  --repo /path/to/PraisonAI

The PoV:

1. injects a fake sandlock module that imports successfully but reports no usable Landlock support;
2. configures SandboxConfig.native(writable_paths=[tenant_a], network=False);
3. creates tenant-b-secret.txt outside the configured path;
4. starts a localhost TCP listener;
5. executes code through SandlockSandbox.execute().

Observed result on v4.6.58:

{
  "child_output": {
    "network_reply": "local-ok",
   …