CVE-2026-57135: PraisonAI Information Disclosure Vulnerability

CVE-2026-57135 Overview

CVE-2026-57135 affects PraisonAI, a multi-agent teams system, in versions from 1.2.3 through 1.7.1. The SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts fails to enforce an operating-system network boundary. Instead, it relies on buildEnv() to inject invalid http_proxy and https_proxy environment variables. Programs that ignore proxy variables can open sockets directly, reaching localhost, internal services, cloud metadata endpoints, or external hosts. The flaw maps to [CWE-653] Improper Isolation or Compartmentalization. An initial remediation was released in version 1.7.2.

Critical Impact
Supposedly isolated sandbox commands can bypass network restrictions, contact cloud metadata services, and potentially exfiltrate sensitive data to attacker-controlled hosts.

Affected Products

PraisonAI versions 1.2.3 through 1.7.1
praisonai-ts package containing SandboxExecutor
Downstream Docker images bundling praisonai<4.6.60

Discovery Timeline

2026-09-15 - CVE-2026-57135 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-57135

Vulnerability Analysis

The SandboxExecutor component provides a network-isolated execution mode for running untrusted commands or agent-generated code. Instead of enforcing isolation at the operating-system layer, the implementation only sets http_proxy and https_proxy environment variables to invalid values through the buildEnv() helper. This approach assumes every child process honors proxy configuration. In practice, many runtimes, compiled binaries, and libraries open raw TCP or UDP sockets directly. Those sockets bypass the proxy variables entirely and connect to any reachable host. The result is a false isolation guarantee for agent workloads that consumers assume are contained.

Root Cause

The root cause is improper compartmentalization [CWE-653]. Environment variables are advisory hints, not enforcement mechanisms. The sandbox lacks a network namespace, firewall rule set, seccomp filter, or container-level egress policy that would block outbound sockets at the kernel level.

Attack Vector

An authenticated user who can submit code or commands to a PraisonAI agent running under SandboxExecutor network-isolated mode can execute a program that opens sockets directly. That program can reach the loopback interface, internal service endpoints, cloud instance metadata services such as 169.254.169.254, or arbitrary internet hosts to exfiltrate data.

text

# Patch reference from docker/Dockerfile.chat (Release v4.6.60)
 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.59" \
+    "praisonai>=4.6.60" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"

Source: GitHub Commit 709a0387

Detection Methods for CVE-2026-57135

Indicators of Compromise

Outbound connections from PraisonAI sandbox processes to 169.254.169.254 or other cloud metadata endpoints.
Sandbox child processes establishing TCP sessions to internal RFC1918 addresses or unexpected external hosts.
Presence of praisonai package versions between 1.2.3 and 1.7.1 in dependency manifests or container images.

Detection Strategies

Inventory Node.js and Python environments for praisonai-ts and praisonai versions below the fixed release.
Correlate process-to-network telemetry for sandbox executor child processes and flag any egress that ignores the injected proxy variables.
Audit agent execution logs for commands that invoke curl, wget, or custom binaries that use raw sockets.

Monitoring Recommendations

Enable egress logging on hosts and containers running PraisonAI and alert on connections to metadata IPs or non-approved destinations.
Monitor DNS queries from sandbox workloads for lookups outside an approved allowlist.
Track invocations of SandboxExecutor in application logs and pair them with per-process network flow records.

How to Mitigate CVE-2026-57135

Immediate Actions Required

Upgrade PraisonAI to version 1.7.2 or later, and update Docker images to praisonai>=4.6.60.
Restrict which users or agents can invoke SandboxExecutor network-isolated mode until patches are deployed.
Block outbound access to cloud metadata endpoints and internal service ranges from sandbox hosts.

Patch Information

An initial remediation was released in PraisonAI 1.7.2. Container images were updated in release v4.6.60, which pins praisonai>=4.6.60 in both docker/Dockerfile.chat and docker/Dockerfile.dev. See the GitHub Security Advisory GHSA-gqmf-56h7-rrpf and the GitHub Release v4.6.60 notes for details.

Workarounds

Run sandboxed agent code inside a dedicated network namespace or container with an explicit egress-deny firewall policy.
Apply iptables or nftables rules that drop outbound traffic from sandbox users except to an approved allowlist.
Use a rootless container runtime and disable access to the instance metadata service using IMDSv2 with hop-limit 1 on AWS or equivalent controls on other clouds.

bash

# Example egress restriction for a sandbox user on Linux
sudo useradd -r -s /usr/sbin/nologin praison-sandbox
sudo iptables -A OUTPUT -m owner --uid-owner praison-sandbox -d 169.254.169.254 -j DROP
sudo iptables -A OUTPUT -m owner --uid-owner praison-sandbox -d 10.0.0.0/8 -j DROP
sudo iptables -A OUTPUT -m owner --uid-owner praison-sandbox -d 172.16.0.0/12 -j DROP
sudo iptables -A OUTPUT -m owner --uid-owner praison-sandbox -d 192.168.0.0/16 -j DROP