https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 21:22:44 +0000 https://vulnerability.circl.lu/vuln/pysec-2026-3504 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>## Summary</p> <p>`praisonai.sandbox.SandlockSandbox` is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its `SandboxConfig.native()` path lets callers configure allowed filesystem paths and `network=False`.</p> <p>On systems where the optional `sandlock` module imports but reports that Landlock is unavailable, `SandlockSandbox.execute()` and `run_command()` do not fail closed. They silently fall back to `SubprocessSandbox(self.config)`.</p> <p>That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite `network=False`.</p> <p>## Technical Details</p> <p>`SandboxConfig.native()` creates a restricted native policy and records caller-provided writable paths plus the requested network posture:</p> <p>```python return cls( sandbox_type=&#34;native&#34;, working_dir=os.getcwd(), security_policy=SecurityPolicy( allow_network=network, allow_file_write=True, allow_subprocess=True, allowed_paths=resolved_paths, ), metadata={&#34;writable_paths&#34;: resolved_paths, &#34;network&#34;: network}, ) ```</p> <p>`SandlockSandbox` builds the intended kernel policy with Landlock-backed filesystem allowlisting and network denial:</p> <p>```python policy = Policy( fs_readable=allowed_read_paths, fs_writable=allowed_write_paths, net_allow_hosts=[] if not limits.network_enab…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>## Summary</p> <p>`praisonai.sandbox.SandlockSandbox` is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its `SandboxConfig.native()` path lets callers configure allowed filesystem paths and `network=False`.</p> <p>On systems where the optional `sandlock` module imports but reports that Landlock is unavailable, `SandlockSandbox.execute()` and `run_command()` do not fail closed. They silently fall back to `SubprocessSandbox(self.config)`.</p> <p>That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite `network=False`.</p> <p>## Technical Details</p> <p>`SandboxConfig.native()` creates a restricted native policy and records caller-provided writable paths plus the requested network posture:</p> <p>```python return cls( sandbox_type=&#34;native&#34;, working_dir=os.getcwd(), security_policy=SecurityPolicy( allow_network=network, allow_file_write=True, allow_subprocess=True, allowed_paths=resolved_paths, ), metadata={&#34;writable_paths&#34;: resolved_paths, &#34;network&#34;: network}, ) ```</p> <p>`SandlockSandbox` builds the intended kernel policy with Landlock-backed filesystem allowlisting and network denial:</p> <p>```python policy = Policy( fs_readable=allowed_read_paths, fs_writable=allowed_write_paths, net_allow_hosts=[] if not limits.network_enab…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3504