CVE-2026-57135: PraisonAI sandbox network isolation

CISO Take

PraisonAI's SandboxExecutor claims to run commands in a network-isolated mode, but it only sets invalid http_proxy and https_proxy environment variables, so any program that ignores those variables can still open sockets directly. That means code the agent runs inside the "isolated" sandbox can reach localhost services, internal systems, cloud metadata endpoints, and external hosts, and can exfiltrate data. Exploitation likelihood is currently low: EPSS is 0.00416 (top 66%), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC says Track*. The risk is still real for teams that run LLM-generated or untrusted code through PraisonAI agents and rely on this mode as a security boundary, especially on cloud hosts where metadata credentials are reachable. Upgrade PraisonAI to 1.7.2 or later (the advisory describes it as an initial remediation, so keep watching GHSA-gqmf-56h7-rrpf for follow-ups). Until then, enforce isolation at the OS, container, or network-policy level and block metadata endpoints.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

High severity (CVSS 7.6) with network attack vector, low complexity and low privileges, but a low observed exploitation likelihood (EPSS 0.00416, not in KEV, no public exploit). The core flaw is a false sense of security (CWE-653 improper isolation, CWE-693 protection mechanism failure). Exposure depends on whether the deployment executes untrusted or model-generated code via SandboxExecutor in network-isolated mode. Confidentiality impact is high because of possible access to cloud metadata credentials and internal services. Integrity and availability impact are limited. The vendor's fix is described as an initial remediation, so residual risk may remain after patching.

How does the attack unfold?

Initial Access

Attacker influences an agent via prompt injection or direct low-privilege access to get commands run in the sandbox executor.

AML.T0051.001

Sandbox Bypass

A command that ignores the invalid proxy variables opens direct sockets, bypassing the supposed network isolation.

AML.T0105

Internal Discovery

The command reaches localhost, internal services, and the cloud metadata endpoint to collect credentials and data.

AML.T0075

Exfiltration

Collected data is sent to an attacker-controlled external host over an unrestricted network path.

AML.T0025

Initial Access

Attacker influences an agent via prompt injection or direct low-privilege access to get commands run in the sandbox executor.

AML.T0051.001

Sandbox Bypass

A command that ignores the invalid proxy variables opens direct sockets, bypassing the supposed network isolation.

AML.T0105

Internal Discovery

The command reaches localhost, internal services, and the cloud metadata endpoint to collect credentials and data.

AML.T0075

Exfiltration

Collected data is sent to an attacker-controlled external host over an unrestricted network path.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

ILow

ALow

What should I do?

1 step

1) Upgrade PraisonAI to 1.7.2 or later and review the advisory GHSA-gqmf-56h7-rrpf and commit 709a038 for the fix scope. 2) Do not rely on proxy environment variables for isolation: run agent execution in containers or VMs with network namespaces, --network none, or default-deny egress firewall rules. 3) Block access to cloud metadata endpoints (169.254.169.254) from agent hosts, enforce IMDSv2 with hop limit 1, and use least-privilege instance roles. 4) Restrict localhost and internal service reachability from agent runtime hosts using network policies. 5) Detection: monitor egress from agent hosts for direct connections that skip the configured proxy, DNS queries to unfamiliar domains, and metadata endpoint access. 6) Inventory where PraisonAI versions 1.2.3 to 1.7.1 are deployed and which agents can execute commands.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageCode ExecutionAgentFrameworkAML.T0025- Exfiltration via Cyber Means AML.T0075- Cloud Service Discovery AML.T0086- Exfiltration via AI Agent Tool Invocation AML.T0105- Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and recover from unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-57135?

PraisonAI's SandboxExecutor claims to run commands in a network-isolated mode, but it only sets invalid http_proxy and https_proxy environment variables, so any program that ignores those variables can still open sockets directly. That means code the agent runs inside the "isolated" sandbox can reach localhost services, internal systems, cloud metadata endpoints, and external hosts, and can exfiltrate data. Exploitation likelihood is currently low: EPSS is 0.00416 (top 66%), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC says Track*. The risk is still real for teams that run LLM-generated or untrusted code through PraisonAI agents and rely on this mode as a security boundary, especially on cloud hosts where metadata credentials are reachable. Upgrade PraisonAI to 1.7.2 or later (the advisory describes it as an initial remediation, so keep watching GHSA-gqmf-56h7-rrpf for follow-ups). Until then, enforce isolation at the OS, container, or network-policy level and block metadata endpoints.

Is CVE-2026-57135 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57135, increasing the risk of exploitation.

How to fix CVE-2026-57135?

1) Upgrade PraisonAI to 1.7.2 or later and review the advisory GHSA-gqmf-56h7-rrpf and commit 709a038 for the fix scope. 2) Do not rely on proxy environment variables for isolation: run agent execution in containers or VMs with network namespaces, --network none, or default-deny egress firewall rules. 3) Block access to cloud metadata endpoints (169.254.169.254) from agent hosts, enforce IMDSv2 with hop limit 1, and use least-privilege instance roles. 4) Restrict localhost and internal service reachability from agent runtime hosts using network policies. 5) Detection: monitor egress from agent hosts for direct connections that skip the configured proxy, DNS queries to unfamiliar domains, and metadata endpoint access. 6) Inventory where PraisonAI versions 1.2.3 to 1.7.1 are deployed and which agents can execute commands.

What systems are affected by CVE-2026-57135?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, sandboxed code execution, multi-agent systems, tool-using LLM agents.

What is the CVSS score for CVE-2026-57135?

CVE-2026-57135 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.42%.

What is the AI security impact?

Affected AI Architectures

agent frameworkssandboxed code executionmulti-agent systemstool-using LLM agents

MITRE ATLAS Techniques

AML.T0025Exfiltration via Cyber Means

AML.T0075Cloud Service Discovery

AML.T0086Exfiltration via AI Agent Tool Invocation

AML.T0105Escape to Host

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to inject invalid http_proxy and https_proxy environment variables and does not establish an operating-system network boundary. Programs that ignore those proxy variables can open sockets directly, allowing supposedly isolated commands to reach localhost, internal services, cloud metadata, or external hosts and potentially exfiltrate data. An initial remediation was released in version 1.7.2.

Exploitation Scenario

An attacker plants an indirect prompt injection in a document or web page that a PraisonAI agent processes. The injected instructions cause the agent to run a command in the sandbox executor's network-isolated mode, for example a script using raw sockets or curl with --noproxy. Because the invalid proxy variables are ignored, the command reaches the cloud metadata service, harvests temporary credentials, probes internal services on localhost, and posts the results to an attacker-controlled host. The operator believed the sandbox blocked all network access.

Weaknesses (CWE)

CWE-653Improper Isolation or CompartmentalizationPrimary CWE-693Protection Mechanism FailurePrimary CWE-653Improper Isolation or Compartmentalization CWE-693Protection Mechanism Failure

CWE-653 — Improper Isolation or Compartmentalization: The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

[Architecture and Design] Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.

Source: MITRE CWE corpus.