PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Summary

CodeAgent._execute_python() executes LLM-generated Python code in a subprocess with the complete parent-process environment (os.environ.copy()), zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfig(sandbox=True) is explicitly set. This allows an attacker who can influence LLM output (via prompt injection in agent input, tool results, or ingested content) to exfiltrate all environment secrets (API keys, database credentials, cloud tokens) and execute arbitrary code on the host.

Details

src/praisonai-agents/praisonaiagents/agent/code_agent.py (lines 253–308):

def _execute_python(self, code: str, **kwargs) -> Dict[str, Any]:
    import subprocess
    import time
    import tempfile
    import os

    start_time = time.time()

    # Write code to temp file
    with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as f:
        f.write(code)           # ← No AST validation, no import blocking
        temp_file = f.name

    try:
        # Execute in subprocess (basic sandboxing)
        env = os.environ.copy()             # ← FULL parent environment
        env.update(self._code_config.environment)

        result = subprocess.run(
            ["python", temp_file],
            capture_output=True,
            text=True,
            timeout=self._code_config.timeout,
            cwd=self._code_config.working_directory,
            env=env                         # ← All secrets exposed
        )

Key issues:

1. Environment leak: os.environ.copy() passes every environment variable — OPENAI_API_KEY, DATABASE_URL, AWS credentials, etc. to the subprocess. By contrast, the sandboxed execute_code tool in python_tools.py uses env={} (empty environment).

2. No AST validation: The LLM-generated code string is written directly to a temp file and executed. No _validate_code_ast() call, no import blocking, no builtin restrictions.

3. sandbox=True is dead code: CodeConfig defines sandbox: bool = True (line 21), but _execute_python never checks this field. The comment "basic sandboxing" at line 268 is misleading — the only isolation is subprocess execution.

4. No import restrictions: The code can import os, import subprocess, import urllib.request, , etc.