title: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)
id: ATR-2026-01953
rule_version: 1
status: experimental
description: |
  Detects GHSA-vmmj-pfw7-fjwp (CRITICAL): praisonai npm >= 1.4.0 <= 1.7.1 exposes a `codeMode` builtin tool (src/tools/builtins/code-mode.ts) that claims sandbox:true but executes the supplied `code` in the HOST V8 context via `new Function('sandbox', 'with (sandbox) { ' + code + ' }')`. Setting process/require to undefined and blocklisting `require('fs')` is bypassed by recovering the real Function constructor through the prototype chain. This rule keys on the distinctive breakout tokens: `.constructor.constructor('return process')()` and `process.mainModule.require`, which let attacker code reach fs / child_process for host RCE. Fixed in 1.7.2.
author: ATR Community
date: 2026/06/29
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM05:2025
    - LLM06:2025
  owasp_agentic:
    - ASI05:2026
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
    - AML.T0105 - Escape to Host
  mitre_attack:
    - T1190 - Exploit Public-Facing Application
  cve:
    - GHSA-vmmj-pfw7-fjwp
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: 'Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp).'
      strength: primary
    - article: '9'
      context: 'Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp).'
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: 'NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp).'
      strength: primary
    - subcategory: MG.3.2
      context: 'NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp).'
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: 'ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp).'
      strength: primary
    - clause: '8.3'
      context: 'ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp).'
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: sandbox-escape
  scan_target: both
  confidence: high
  source: cve-disclosure
  vendor_sources: praisonai-ghsa-vmmj-pfw7-fjwp
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Security advisory or blog text quoting the GHSA-vmmj-pfw7-fjwp PoC for documentation, without it being executed as codeMode input.
    - Legitimate code that references `constructor` once (e.g. `obj.constructor.name`) or uses a single `new Function(...)` for templating, without the double-constructor `return process` breakout.
    - Node app legitimately reading `process.env` or `process.mainModule` in trusted host code that is not submitted to a sandboxed codeMode/eval tool.
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:\(\s*\{\s*\}\s*\)|[\w$\]\)]\s*|["\x27]["\x27]\s*)\.\s*constructor\s*\.\s*constructor\s*\(\s*["\x27]\s*return\s+(?:process|global|require|this)\b
      description: 'Prototype-chain Function-constructor breakout: x.constructor.constructor(''return process''/global/require) — the GHSA-vmmj-pfw7-fjwp escape primitive'
    - field: content
      operator: regex
      value: (?i)process\s*\.\s*mainModule\s*\.\s*require\s*\(\s*["\x27](?:child_process|fs|os|vm|module)["\x27]
      description: 'Post-escape host access: process.mainModule.require(''child_process''/''fs'') used to reach blocked modules after sandbox bypass'
    - field: content
      operator: regex
      value: (?i)new\s+Function\s*\(\s*["\x27]sandbox["\x27]\s*,\s*[`"\x27]\s*with\s*\(\s*sandbox\s*\)
      description: 'The vulnerable sink itself: new Function("sandbox", "with (sandbox) { ... }") host-context eval in code-mode.ts'
    - field: content
      operator: regex
      value: (?i)GHSA-vmmj-pfw7-fjwp[\s\S]{0,200}(?:codeMode|sandbox\s*escape|Function\s*constructor|return\s+process)
      description: explicit GHSA framing combined with the codeMode/Function-constructor exploit vocabulary
response:
  actions:
    - alert
    - block_input
  message_template: |
    [ATR-2026-01953] CRITICAL: PraisonAI codeMode sandbox escape (GHSA-vmmj-pfw7-fjwp) — prototype-chain Function-constructor breakout (`.constructor.constructor('return process')()` / process.mainModule.require) grants host fs + child_process RCE despite sandbox:true. Block and upgrade praisonai to >= 1.7.2.
confidence: 85