CVE-2026-57141: PraisonAI JavaScript Sandbox RCE Vulnerability

CVE-2026-57141 Overview

CVE-2026-57141 is a code injection vulnerability [CWE-94] in PraisonAI, a multi-agent teams system. The flaw exists in the codeMode tool located at src/praisonai-ts/src/tools/builtins/code-mode.ts. This tool executes model-generated JavaScript using new Function() combined with with(sandbox). A regular-expression blocklist intended to restrict dangerous APIs can be bypassed using Function('return this')() to recover the global object. Attackers can also dynamically construct the child_process module name to evade string matching. Any actor able to influence the code argument gains host process capabilities including file access, environment credential theft, and arbitrary operating system command execution.

Critical Impact
Remote attackers who influence model-generated code can escape the sandbox and execute operating system commands with PraisonAI process privileges, exposing credentials and host resources.

Affected Products

PraisonAI multi-agent teams system
praisonai-ts package versions prior to 1.7.2
praisonai distribution versions prior to 4.6.60

Discovery Timeline

2026-09-15 - CVE-2026-57141 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-57141

Vulnerability Analysis

The codeMode tool implements a JavaScript execution sandbox using two dangerous primitives. It wraps untrusted code with new Function() and injects the sandbox object through a with(sandbox) block. This construction places attacker-controlled code within the same JavaScript realm as the host Node.js process.

The developers added a regular-expression blocklist to filter dangerous identifiers such as require, process, and child_process. Regular expression filtering of JavaScript source is insufficient because the language provides multiple reflection paths to reach global objects.

Once an attacker escapes the intended scope, they inherit every capability of the PraisonAI process. This includes reading arbitrary files, exfiltrating environment variables containing API keys, and executing shell commands.

Root Cause

The root cause is unsafe evaluation of untrusted input combined with a blocklist-based defense. new Function() in Node.js creates a function whose scope chain terminates at the global object, and with(sandbox) does not create a true isolation boundary. Blocklists cannot enumerate every syntactic form that resolves to sensitive APIs.

Attack Vector

An attacker influences the code argument passed to the codeMode tool. This influence can arrive through prompt injection against the language model, a malicious upstream agent, or a compromised tool integration. The payload uses Function('return this')() to obtain the global object, then dynamically constructs the string child_process from concatenated substrings to bypass the blocklist. The resulting require('child_process').exec() call runs commands under the PraisonAI process account.

text

# Patch reference: docker/Dockerfile.chat (Release v4.6.60)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.59" \
+    "praisonai>=4.6.60" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"

Source: GitHub Commit 709a038

Detection Methods for CVE-2026-57141

Indicators of Compromise

Unexpected child processes spawned by the Node.js runtime hosting PraisonAI, particularly shells such as /bin/sh, bash, or cmd.exe.
Outbound network connections from the PraisonAI process to unknown destinations that follow tool invocations.
Access to sensitive files such as .env, ~/.aws/credentials, or ~/.ssh/ from the PraisonAI process.
Log entries showing JavaScript payloads containing Function('return this'), string concatenations of child+_process, or reflective property access patterns.

Detection Strategies

Instrument the codeMode tool to log every code argument submitted for evaluation and alert on reflection primitives.
Monitor process ancestry for the PraisonAI runtime and flag any descendant process that is not part of the expected tool inventory.
Deploy endpoint detection to correlate model-driven agent activity with suspicious host behaviors such as credential file reads.

Monitoring Recommendations

Forward Node.js runtime logs, agent tool invocations, and host process telemetry into a centralized SIEM for correlation.
Establish behavioral baselines for the PraisonAI service account and alert on deviations in filesystem or network access.
Track outbound DNS and HTTP requests from agent hosts to detect data exfiltration attempts following exploitation.

How to Mitigate CVE-2026-57141

Immediate Actions Required

Upgrade praisonai-ts to version 1.7.2 or later and the praisonai distribution to version 4.6.60 or later.
Rotate any credentials, API keys, and tokens that were accessible to the PraisonAI process before patching.
Audit recent agent execution logs for evidence of reflective global access or dynamic module name construction.

Patch Information

The fix is published in GitHub Release v4.6.60 and documented in GitHub Security Advisory GHSA-p69m-4f92-2v84. The corresponding source change is available in GitHub Commit 709a038.

Workarounds

Disable the codeMode tool in agent configurations until the patched version is deployed.
Run the PraisonAI process under a dedicated low-privilege user account with no access to production secrets.
Enforce outbound network egress filtering from agent hosts to prevent exfiltration and reverse shell connections.
Isolate the PraisonAI runtime inside a container or sandbox with seccomp and read-only filesystem mounts where possible.

bash

# Upgrade to the patched release
pip install --upgrade "praisonai>=4.6.60"
npm install praisonai-ts@^1.7.2