CVE-2026-57141: PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by constructing the childprocess module name dynamically. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials, and execute operating-system commands with the PraisonAI process privileges. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
PraisonAI deployments using a version prior to 1.7.2 are exposed if an attacker can influence the code argument passed to the codeMode tool. The attacker does not need prior privileges or user interaction.
What can an attacker do after escaping the sandbox?
An attacker can recover the host process capabilities and execute operating-system commands with the privileges of the PraisonAI process. They may also read or write files and obtain environment credentials available to that process.
Is upgrading the available remediation?
Yes. The issue is fixed in PraisonAI version 1.7.2.
How can I determine whether my deployment is affected?
Determine whether the deployed PraisonAI version is earlier than 1.7.2 and whether untrusted parties can influence the code argument supplied to codeMode. The affected implementation is the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts.