CVE-2026-57144: PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and runcommand() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaito a version that resolves this vulnerability.Fixed in 4.6.61
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
PraisonAI versions 4.5.110 through before 4.6.61 are affected when SandlockSandbox is used and the optional sandlock module imports but reports that Landlock is unavailable. The risk applies to deployments relying on SandboxConfig.native() to restrict untrusted code's filesystem access or disable networking.
What access does an attacker need to exploit it?
An attacker needs a way to cause code or commands to run through SandlockSandbox. No user interaction is required, but the attacker must already have the ability to submit or influence a sandboxed payload.
What can a successful exploit do?
The payload can read files outside the configured allowed filesystem paths and make network connections even when network=False is configured. The fallback executes through SubprocessSandbox without enforcing the native filesystem or network boundary.
What should teams do if they cannot update immediately?
Do not rely on SandlockSandbox native policy enforcement on systems where Landlock is unavailable. Avoid running untrusted code through this backend until Landlock availability can be confirmed or the deployment is updated to version 4.6.61.
How can I determine whether my environment is affected?
Check whether PraisonAI is version 4.5.110 or later but earlier than 4.6.61, whether SandboxConfig.native() and SandlockSandbox are used, and whether sandlock reports Landlock as unavailable. In that condition, execute() and run_command() silently use SubprocessSandbox instead of enforcing the configured native restrictions.