https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 23:34:10 +0000 https://db.gcve.eu/vuln/cve-2026-60085 <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.</p> <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.</p> https://db.gcve.eu/vuln/cve-2026-60085 https://db.gcve.eu/vuln/pysec-2026-4250 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allow_subprocess, allowed_paths, blocked_paths, allowed_commands, blocked_commands, allowed_imports, and blocked_imports. Its strict() classmethod is explicitly described as creating &#34;a strict security policy for untrusted code,&#34; setting allow_subprocess=False and allow_file_write=False, and inheriting default blocked_paths (/etc/passwd, /etc/shadow, ~/.ssh, ~/.aws, ~/.config) and blocked_commands (rm -rf, dd, mkfs, fdisk, shutdown, reboot). The default sandbox backend, Subprocess Sandbox (praisonai/sandbox/subprocess.py), implements code/command execution by writing input to a temp file and invoking it via asyncio.create_subprocess_exec() directly, with no checking of any kind against blocked_commands, blocked_imports, blocked_paths, allow_subprocess, or allow_file_write. A search across every sandbox backend file in the repository confirms these fields are referenced nowhere outside the data class that declares them. Only allow_network and max_output_size are actually consulted. Verification Using a Security Policy.strict()-configured Sandbox Config(sandbox_type=&#34;subprocess&#34;) and the real Subprocess Sandbox:</p> <p>subprocess.run([&#39;id&#39;], ...) executed and returned uid=0(root) gid=0(root) groups=0(root) — despite allow_subprocess=False. open(&#39;/etc/passwd&#39;).read() returned the real file contents in full — despite /etc/passwd being explicitly listed in blocked_paths.…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allow_subprocess, allowed_paths, blocked_paths, allowed_commands, blocked_commands, allowed_imports, and blocked_imports. Its strict() classmethod is explicitly described as creating &#34;a strict security policy for untrusted code,&#34; setting allow_subprocess=False and allow_file_write=False, and inheriting default blocked_paths (/etc/passwd, /etc/shadow, ~/.ssh, ~/.aws, ~/.config) and blocked_commands (rm -rf, dd, mkfs, fdisk, shutdown, reboot). The default sandbox backend, Subprocess Sandbox (praisonai/sandbox/subprocess.py), implements code/command execution by writing input to a temp file and invoking it via asyncio.create_subprocess_exec() directly, with no checking of any kind against blocked_commands, blocked_imports, blocked_paths, allow_subprocess, or allow_file_write. A search across every sandbox backend file in the repository confirms these fields are referenced nowhere outside the data class that declares them. Only allow_network and max_output_size are actually consulted. Verification Using a Security Policy.strict()-configured Sandbox Config(sandbox_type=&#34;subprocess&#34;) and the real Subprocess Sandbox:</p> <p>subprocess.run([&#39;id&#39;], ...) executed and returned uid=0(root) gid=0(root) groups=0(root) — despite allow_subprocess=False. open(&#39;/etc/passwd&#39;).read() returned the real file contents in full — despite /etc/passwd being explicitly listed in blocked_paths.…</p> https://db.gcve.eu/vuln/pysec-2026-4250