CVE-2026-57138

PraisonAI, an open-source multi-agent teams framework, ships a built-in 'codeMode' tool whose advertised JavaScript sandbox runs attacker-controlled code via new Function() inside a with(sandbox) block, relying only on a source-code blocklist and shadowed process/require properties. The sandbox is trivially escapable: code can use ({}).constructor.constructor to recover the real Function constructor, then reach process and process.mainModule.require to access the host filesystem and spawn subprocesses. An attacker who controls codeMode input (e.g., via prompt injection into an agent pipeline or untrusted user-supplied agent definitions) can read secrets, modify files, execute arbitrary commands, or exhaust the host process, achieving full host compromise with only low privileges required. Affected deployments are PraisonAI 1.4.0 through 1.7.1 wherever the codeMode tool is enabled, particularly self-hosted agent services that execute model-generated code. No public PoC is known and the flaw is not on the CISA KEV catalog, so exploitation status is none known, though the bypass technique is well-understood.

What to do: Upgrade PraisonAI to version 1.7.2 or later, where the sandbox escape is fixed. Until patched, disable or tightly restrict the codeMode tool and never run agent-generated code on hosts with access to secrets, credentials, or sensitive files. Run agent code-execution tools inside an isolated container or sandboxed worker (seccomp/gVisor/no network or filesystem access), and audit existing deployments for unexpected file reads/writes, subprocess spawns, or exfiltration of environment variables.