CVE-2026-57138: PraisonAI codeMode sandbox escape

CISO Take

PraisonAI's TypeScript codeMode tool claims to sandbox untrusted JavaScript, but it relies on a source blocklist and shadowed globals. An attacker can recover the real Function constructor via ({}).constructor.constructor and reach process.mainModule.require, which gives full host filesystem and command execution. The CVSS is 9.9 (scope changed, low privileges, no user interaction), so any user or agent able to feed input into codeMode can take over the host and steal API keys and secrets. Exploitation pressure is currently modest: EPSS is 0.73% (top 47%), it is not in CISA KEV, and there is no public exploit or Nuclei template, but the escape technique is well known and trivial to weaponize, and CISA SSVC rates it ATTEND. Upgrade to PraisonAI 1.7.2 or later, disable codeMode wherever untrusted or LLM-generated code can reach it, and run any code execution in a real isolation boundary such as a container or VM with no secrets mounted.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

High to critical. The attack is network-reachable, low complexity, needs only low privileges and no user interaction, and the changed scope means compromise extends beyond the sandbox to the host. Exploitation likelihood today is moderate (EPSS 0.73%, no KEV, no public exploit), but the JavaScript Function-constructor escape is a widely documented technique, so time-to-weaponization is short. Exposure is highest where codeMode accepts input from end users, or from LLM output that can be steered by prompt injection. Affected versions are 1.4.0 up to the 1.7.2 fix.

How does the attack unfold?

Initial Access

The attacker supplies JavaScript to codeMode directly or by steering an agent via prompt injection.

AML.T0049

Sandbox Escape

The payload uses ({}).constructor.constructor to recover the real Function constructor and obtain process.mainModule.require.

AML.T0105

Execution

The attacker runs host commands and reads files via child_process and fs APIs.

AML.T0050

Impact

Secrets are stolen, files are modified or a backdoor is planted, and the host can be exhausted or used to pivot.

AML.T0055

Initial Access

The attacker supplies JavaScript to codeMode directly or by steering an agent via prompt injection.

AML.T0049

Sandbox Escape

The payload uses ({}).constructor.constructor to recover the real Function constructor and obtain process.mainModule.require.

AML.T0105

Execution

The attacker runs host commands and reads files via child_process and fs APIs.

AML.T0050

Impact

Secrets are stolen, files are modified or a backdoor is planted, and the host can be exhausted or used to pivot.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade PraisonAI to 1.7.2 or later (see the GHSA-vmmj-pfw7-fjwp advisory and the fix commit). 2) Until patched, disable codeMode or restrict it to fully trusted callers; do not expose it to LLM-generated or user-supplied code. 3) Run agent workloads in containers or VMs with a non-root user, read-only filesystem, no outbound network by default, and no long-lived secrets in the environment. 4) Rotate any secrets that were accessible to hosts running affected versions with codeMode exposed. 5) Detect: monitor for child processes spawned by the Node agent runtime, unexpected file reads of .env or credential files, and codeMode inputs containing 'constructor.constructor', 'mainModule' or 'require('child_process')'. 6) Do not rely on in-process JavaScript sandboxes such as new Function or with() as a security boundary.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData LeakageAgentFrameworkPluginAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0055- Unsecured Credentials AML.T0105- Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are followed

OWASP LLM Top 10

LLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-57138?

PraisonAI's TypeScript codeMode tool claims to sandbox untrusted JavaScript, but it relies on a source blocklist and shadowed globals. An attacker can recover the real Function constructor via ({}).constructor.constructor and reach process.mainModule.require, which gives full host filesystem and command execution. The CVSS is 9.9 (scope changed, low privileges, no user interaction), so any user or agent able to feed input into codeMode can take over the host and steal API keys and secrets. Exploitation pressure is currently modest: EPSS is 0.73% (top 47%), it is not in CISA KEV, and there is no public exploit or Nuclei template, but the escape technique is well known and trivial to weaponize, and CISA SSVC rates it ATTEND. Upgrade to PraisonAI 1.7.2 or later, disable codeMode wherever untrusted or LLM-generated code can reach it, and run any code execution in a real isolation boundary such as a container or VM with no secrets mounted.

Is CVE-2026-57138 actively exploited?

No confirmed active exploitation of CVE-2026-57138 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57138?

1) Upgrade PraisonAI to 1.7.2 or later (see the GHSA-vmmj-pfw7-fjwp advisory and the fix commit). 2) Until patched, disable codeMode or restrict it to fully trusted callers; do not expose it to LLM-generated or user-supplied code. 3) Run agent workloads in containers or VMs with a non-root user, read-only filesystem, no outbound network by default, and no long-lived secrets in the environment. 4) Rotate any secrets that were accessible to hosts running affected versions with codeMode exposed. 5) Detect: monitor for child processes spawned by the Node agent runtime, unexpected file reads of .env or credential files, and codeMode inputs containing 'constructor.constructor', 'mainModule' or 'require('child_process')'. 6) Do not rely on in-process JavaScript sandboxes such as new Function or with() as a security boundary.

What systems are affected by CVE-2026-57138?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, code execution tools, LLM tool-calling pipelines.

What is the CVSS score for CVE-2026-57138?

CVE-2026-57138 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.73%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemscode execution toolsLLM tool-calling pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0055Unsecured Credentials

AML.T0105Escape to Host

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist plus shadowed process and require properties. Code can use ({}).constructor.constructor to recover the real Function constructor, obtain process and process.mainModule.require, and reach host filesystem and subprocess APIs despite the advertised sandbox. Attackers who control codeMode input can read secrets, modify files, execute commands, or exhaust the host process. This issue is fixed in version 1.7.2.

Exploitation Scenario

An attacker with a low-privilege account on an application built on PraisonAI submits a task that reaches codeMode, either directly or by prompt-injecting the agent into generating code. The payload uses ({}).constructor.constructor('return process')() to recover the real process object, then process.mainModule.require('child_process') to run commands. The attacker dumps environment variables with LLM and cloud API keys, reads files on the host, plants a persistent backdoor in the agent's code, and pivots into internal services the agent can reach.

Weaknesses (CWE)

CWE-184Incomplete List of Disallowed InputsPrimary CWE-693Protection Mechanism FailurePrimary CWE-184Incomplete List of Disallowed Inputs CWE-693Protection Mechanism Failure

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.