PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.

Affected: PyPI: praisonaiagents

### Summary `CodeAgent._execute_python()` executes LLM-generated Python code in a subprocess with the complete parent-process environment (`os.environ.copy()`), zero AST validation, zero import restrictions, and no sandbox enforcement — even when `CodeConfig(sandbox=True)` is explicitly set. This allows an attacker who can influence LLM output (via prompt injection in agent input, tool results, or ingested content) to exfiltrate all environment secrets (API keys, database credentials, cloud tokens) and execute arbitrary code on the host.

### Details

`src/praisonai-agents/praisonaiagents/agent/code_agent.py` (lines 253–308):

```python def _execute_python(self, code: str, **kwargs) -> Dict[str, Any]: import subprocess import time import tempfile import os

start_time = time.time()

# Write code to temp file with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as f: f.write(code) # ← No AST validation, no import blocking temp_file = f.name

try: # Execute in subprocess (basic sandboxing) env = os.environ.copy() # ← FULL parent environment env.update(self._code_config.environment)

result = subprocess.run( ["python", temp_file], capture_output=True, text=True, timeout=self._code_config.timeout, cwd=self._code_config.working_directory, env=env # ← All secrets expos…