GHSA-vmmj-pfw7-fjwp

## Summary The published npm package `praisonai` exports a TypeScript built-in tool named `codeMode`. The package describes this tool as executing code in a sandboxed environment, marks its capability as `sandbox: true`, and registers it through the public tools facade. The implementation does not create an isolation boundary. It applies a small regular-expression blocklist, sets `process` and `require` to `undefined` inside a plain JavaScript object, and then executes attacker-controlled code with the host process `new Function` constructor: ```text const fn = new Function('sandbox', `with (sandbox) { ${code} }`); const result = fn(sandbox); ``` Because this runs in the host V8 context, code inside `codeMode` can use the JavaScript prototype chain to recover the real `Function` constructor: ```text ({}).constructor.constructor('return process')() ``` From a normal CommonJS application script, the recovered `process` object exposes `process.mainModule.require`. That bypasses the explicit `require('fs')` and `require('child_process')` controls and allows host filesystem access and subprocess execution from code that was supposed to be sandboxed. ## Technical Details Current-head source says `codeMode` is a built-in package tool and explicitly advertises a sandbox boundary: ```text src/praisonai-ts/src/tools/builtins/code-mode.ts 13: description: 'Execute code that can import and use other tools in a sandboxed environment', 24: capabilities: { 25: sandbox: true, 26: code: true, 28: packageName: 'praisonai', 85: description: 'Execute code in a sandboxed environment with access to imported tools. Write files, run code, and get results.', ``` The same file implements security as a blocklist of exact source-code patterns: ```text src/praisonai-ts/src/tools/builtins/code-mode.ts 108: const blockedPatterns = [ 109: /require\s*\(\s*['"]child_process['"]\s*\)/, 110: /require\s*\(\s*['"]fs['"]\s*\)/, 111: /import\s+.*from\s+['"]child_pr