PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.

Affected: PyPI: praisonai

## Summary

`praisonai.sandbox.SandlockSandbox` is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its `SandboxConfig.native()` path lets callers configure allowed filesystem paths and `network=False`.

On systems where the optional `sandlock` module imports but reports that Landlock is unavailable, `SandlockSandbox.execute()` and `run_command()` do not fail closed. They silently fall back to `SubprocessSandbox(self.config)`.

That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite `network=False`.

## Technical Details

`SandboxConfig.native()` creates a restricted native policy and records caller-provided writable paths plus the requested network posture:

```python return cls( sandbox_type="native", working_dir=os.getcwd(), security_policy=SecurityPolicy( allow_network=network, allow_file_write=True, allow_subprocess=True, allowed_paths=resolved_paths, ), metadata={"writable_paths": resolved_paths, "network": network}, ) ```

`SandlockSandbox` builds the intended kernel policy with Landlock-backed filesystem allowlisting and network denial:

```python policy = Policy( fs_readable=allowed_read_paths, fs_writable=allowed_write_paths, net_allow_hosts=[] if not limits.network_enab…

Affected: PyPI: praisonai

## Summary

`praisonai.sandbox.SandlockSandbox` is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its `SandboxConfig.native()` path lets callers configure allowed filesystem paths and `network=False`.

On systems where the optional `sandlock` module imports but reports that Landlock is unavailable, `SandlockSandbox.execute()` and `run_command()` do not fail closed. They silently fall back to `SubprocessSandbox(self.config)`.

That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite `network=False`.

## Technical Details

`SandboxConfig.native()` creates a restricted native policy and records caller-provided writable paths plus the requested network posture:

```python return cls( sandbox_type="native", working_dir=os.getcwd(), security_policy=SecurityPolicy( allow_network=network, allow_file_write=True, allow_subprocess=True, allowed_paths=resolved_paths, ), metadata={"writable_paths": resolved_paths, "network": network}, ) ```

`SandlockSandbox` builds the intended kernel policy with Landlock-backed filesystem allowlisting and network denial:

```python policy = Policy( fs_readable=allowed_read_paths, fs_writable=allowed_write_paths, net_allow_hosts=[] if not limits.network_enab…