CVE-2026-57135

PraisonAI, an open-source multi-agent framework, ships a SandboxExecutor 'network-isolated' mode (src/praisonai-ts/src/cli/features/sandbox-executor.ts) that only sets invalid http_proxy/https_proxy environment variables instead of enforcing a real operating-system network boundary. Any sandboxed command or spawned program that simply ignores those proxy variables can open sockets directly, so code that was supposed to be cut off from the network can reach localhost services, internal networks, cloud metadata endpoints (e.g., 169.254.169.254), or external hosts. An attacker with low privileges who can influence the commands an agent executes in the sandbox — for example, via malicious code, prompts, or tool outputs — gains network reach that the sandbox explicitly promised to deny, enabling data exfiltration and attacks on adjacent services. All versions from 1.2.3 up to (but not including) 1.7.2 are affected; version 1.7.2 contains an initial remediation. No public proof-of-concept or in-the-wild exploitation is known at this time.

What to do: Upgrade PraisonAI to version 1.7.2 or later, where an initial remediation was released, and verify no affected copies remain in CI or container images. Do not treat the proxy-variable mechanism as a security boundary: run untrusted agent-generated commands inside a container or network namespace with networking disabled, or enforce egress rules via host firewall. Review logs of sandboxed executions for outbound connections, access to 169.254.169.254 or other metadata IPs, and unexpected localhost/internal service traffic, and rotate any credentials exposed to those environments.