CVE-2026-57135: PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to inject invalid httpproxy and httpsproxy environment variables and does not establish an operating-system network boundary. Programs that ignore those proxy variables can open sockets directly, allowing supposedly isolated commands to reach localhost, internal services, cloud metadata, or external hosts and potentially exfiltrate data. An initial remediation was released in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAI SandboxExecutorto a version that resolves this vulnerability.Fixed in 1.7.2 - Compensating control
Ensure network-isolated mode provides a true operating-system network boundary (not only buildEnv() injection of invalid http_proxy/https_proxy). If OS-level isolation is not available, add an external control such as host/network firewall rules or container/network policy that blocks direct socket egress (including to localhost, internal services, and cloud metadata) from SandboxExecutor-managed processes.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using PraisonAI SandboxExecutor's network-isolated mode are affected from version 1.2.3 through 1.7.2. The mode does not create an operating-system network boundary.
What does an attacker need to exploit this?
An attacker needs the ability to cause a command or program to run in the supposedly network-isolated sandbox. The program must use a network client that ignores the injected invalid http_proxy and https_proxy variables and opens sockets directly.
What resources could a sandboxed program reach?
A bypassing program may be able to reach localhost services, internal network services, cloud metadata endpoints, or external hosts. This could enable data exfiltration from the environment where the sandbox runs.
Is upgrading to version 1.7.2 sufficient?
Version 1.7.2 is identified as the initial remediation release, but the affected range also includes 1.7.2. Review the vendor remediation and use a version confirmed to contain the complete fix.
What can be done before a complete fix is deployed?
Do not rely on SandboxExecutor network-isolated mode as a network-security boundary. Run untrusted sandbox commands only in an environment with externally enforced network controls, such as operating-system, container, or network-level egress restrictions.