CVE-2026-57138: PraisonAI JavaScript Sandbox Escape RCE

CVE-2026-57138 Overview

CVE-2026-57138 is a sandbox escape vulnerability in PraisonAI, a multi-agent teams system. The flaw affects the codeMode implementation in src/praisonai-ts/src/tools/builtins/code-mode.ts from version 1.4.0 through 1.7.1. The component executes untrusted JavaScript using new Function() inside a with(sandbox) block, relying on a source-code blocklist and shadowed process and require properties. Attackers can bypass these controls using ({}).constructor.constructor to recover the real Function constructor and reach Node.js host APIs. The vulnerability is fixed in version 1.7.2.

Critical Impact
Attackers controlling codeMode input can read secrets, modify files, execute arbitrary commands, or exhaust the host process.

Affected Products

PraisonAI versions 1.4.0 through 1.7.1
praisonai-ts package codeMode tool
Deployments using PraisonAI multi-agent code execution features

Discovery Timeline

2026-09-15 - CVE CVE-2026-57138 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-57138

Vulnerability Analysis

The vulnerability resides in the codeMode function within src/praisonai-ts/src/tools/builtins/code-mode.ts. The implementation attempts to sandbox untrusted JavaScript by running it inside a with(sandbox) block created through new Function(). To restrict access to dangerous host APIs, the sandbox shadows the process and require identifiers and applies a source-code blocklist that scans for forbidden strings before execution.

This design is classified under [CWE-184] Incomplete List of Disallowed Inputs. The blocklist approach cannot enumerate every path to the real Function constructor. Once an attacker obtains that constructor, the shadowed identifiers become irrelevant because new code executes in the outer scope with full Node.js privileges.

Root Cause

The root cause is reliance on a denylist plus shadowed globals for sandboxing untrusted code inside the same Node.js process. JavaScript exposes multiple indirect references to the Function constructor through any object literal, so blocking a fixed set of source tokens cannot prevent constructor recovery. The with(sandbox) pattern also fails to isolate the runtime, leaving access to the host filesystem and subprocess APIs.

Attack Vector

An attacker who can supply input to codeMode submits JavaScript that uses ({}).constructor.constructor to obtain the real Function constructor. From there the payload retrieves process and process.mainModule.require, then loads modules such as fs or child_process. This yields file reads, arbitrary writes, command execution, and resource exhaustion against the host running the PraisonAI agent.

text

# Patch reference from docker/Dockerfile.chat (Release v4.6.60)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.59" \
+    "praisonai>=4.6.60" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"

Source: GitHub Commit 709a038

Detection Methods for CVE-2026-57138

Indicators of Compromise

Agent logs containing codeMode inputs that reference constructor.constructor, mainModule, or dynamic require lookups.
Unexpected child processes spawned by the Node.js process hosting PraisonAI, particularly shells or network utilities.
Outbound network connections from PraisonAI hosts to unfamiliar destinations following agent task execution.
Reads of sensitive files such as /etc/passwd, .env, or cloud credential paths by the PraisonAI runtime user.

Detection Strategies

Inspect stored agent prompts and tool inputs for JavaScript patterns that reach Function through indirect object properties.
Correlate PraisonAI process activity with filesystem and subprocess telemetry to surface deviations from expected agent workloads.
Alert on any invocation of child_process, fs, or net modules originating from code paths that include code-mode.ts.

Monitoring Recommendations

Enable verbose logging of codeMode inputs and outputs, and forward those logs to a centralized analytics platform.
Monitor process trees rooted at the PraisonAI runtime for unexpected binary execution, privilege changes, or persistence attempts.
Track integrity of secrets files, SSH keys, and configuration directories accessible to the PraisonAI service account.

How to Mitigate CVE-2026-57138

Immediate Actions Required

Upgrade PraisonAI to version 1.7.2 or later, which removes the vulnerable codeMode sandbox implementation.
Restrict who can submit codeMode inputs, enforcing authentication and authorization on agent task submission endpoints.
Rotate any credentials, API tokens, or keys that were accessible to hosts running vulnerable PraisonAI versions.

Patch Information

The fix ships in PraisonAI 1.7.2 and is referenced in GitHub Security Advisory GHSA-vmmj-pfw7-fjwp. Container deployments should rebuild images using the updated dependency pin shown in GitHub Release v4.6.60 and the remediation commit.

Workarounds

Disable the codeMode tool in agent configurations until the upgrade is deployed.
Run PraisonAI in a locked-down container or virtual machine with read-only filesystems and no outbound network access.
Drop Linux capabilities and apply seccomp profiles that block execve for the Node.js process hosting agents.
Execute untrusted code in a separate isolated runtime such as a dedicated microVM rather than the same Node.js process.

bash

# Pin the fixed PraisonAI version in container builds
pip install --no-cache-dir "praisonai>=4.6.60" "praisonai[chat]"