CVE-2026-57141

PraisonAI, an open-source multi-agent framework, ships a built-in codeMode tool that executes model-generated JavaScript via new Function() inside a with(sandbox) construct, relying on a regular-expression blocklist for safety. Prior to version 1.7.2, an attacker who can influence the code argument (for example through prompt injection or a malicious tool input reaching the agent) can bypass the blocklist using Function('return this')() to recover the global object and dynamically construct the child_process module name. This yields full code execution with the privileges of the PraisonAI process, allowing arbitrary OS commands, file reads and writes, and theft of credentials from the environment. All deployments using the praisonai-ts codeMode tool on versions before 1.7.2 are affected; a fix is available in 1.7.2. No public proof of concept is known and the flaw is not listed in the CISA KEV catalog, so exploitation status is none known.

What to do: Upgrade PraisonAI to version 1.7.2 or later, which replaces the bypassable blocklist sandbox. Until patched, disable or restrict the codeMode tool for agents that handle untrusted input, run agent workloads in an isolated container with least privilege and no secrets in the environment, and review logs for unexpected child_process spawns or file access by the PraisonAI process.