CVE-2026-57141: PraisonAI codeMode sandbox escape

CISO Take

PraisonAI's TypeScript codeMode tool runs model-generated JavaScript through new Function() and with(sandbox), guarded only by a regex blocklist, and that blocklist can be bypassed with Function('return this')() and dynamically built child_process module names. Any attacker who can influence the code argument, for example through prompt injection or an exposed agent endpoint, gets operating-system command execution, file read/write and environment credential theft with the privileges of the PraisonAI process. The CVSS is 9.8 (network, low complexity, no privileges, no user interaction), but there is no CISA KEV listing, no public exploit and no Nuclei template. EPSS is low at 0.00745 (47th percentile) and CISA SSVC is TRACK*, so this is not yet actively exploited, although the bypass technique is well known and easy to reproduce. Upgrade the TypeScript package to 1.7.2 or later, and until then disable codeMode or run the agent in an isolated container with no secrets mounted. Note that the advisory references release v4.6.60, so confirm the fixed version against the GHSA before closing the ticket.

Sources:NVDEPSSGitHub AdvisoryATLASCISA SSVC

What is the risk?

Severity is critical (CVSS 9.8) because exploitation requires no authentication or user interaction and gives full confidentiality, integrity and availability impact. Real-world likelihood is moderate to low today: EPSS is 0.00745 (47th percentile), there is no KEV entry, no public exploit and no scanner template, and SSVC is TRACK*. Exposure depends on whether the codeMode tool is enabled and whether untrusted input, such as user prompts, retrieved documents or web content, can reach the code argument. The sandbox escape itself is trivial for anyone who knows JavaScript, so the risk can rise quickly once a proof of concept appears. Agents that run with cloud credentials or broad network access carry the highest impact.

How does the attack unfold?

Initial Access

Attacker reaches an exposed PraisonAI agent or plants malicious instructions in content the agent processes, influencing the codeMode code argument.

AML.T0049

Sandbox Escape

Injected JavaScript uses Function('return this')() and dynamically built module names to bypass the regex blocklist and reach child_process.

AML.T0053

Execution and Credential Theft

Arbitrary OS commands run with the PraisonAI process privileges, and environment variables, API keys and files are read.

AML.T0050

Impact

Attacker exfiltrates secrets, establishes persistence and pivots to connected data stores and cloud services.

AML.T0025

Initial Access

Attacker reaches an exposed PraisonAI agent or plants malicious instructions in content the agent processes, influencing the codeMode code argument.

AML.T0049

Sandbox Escape

Injected JavaScript uses Function('return this')() and dynamically built module names to bypass the regex blocklist and reach child_process.

AML.T0053

Execution and Credential Theft

Arbitrary OS commands run with the PraisonAI process privileges, and environment variables, API keys and files are read.

AML.T0050

Impact

Attacker exfiltrates secrets, establishes persistence and pivots to connected data stores and cloud services.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 55% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade the PraisonAI TypeScript package to 1.7.2 or later and verify the fix against the GHSA-p69m-4f92-2v84 advisory and commit 709a038. 2) If patching is not immediately possible, disable or remove the codeMode tool from agent configurations and tool registries. 3) Run agents in containers or VMs with a non-root user, read-only filesystem, no outbound network except required endpoints, and minimal secrets. 4) Rotate any API keys, tokens and cloud credentials that were available to exposed PraisonAI processes. 5) Detect abuse by alerting on node processes spawning shells or child processes, on tool-call logs containing Function('return this'), child_process, require or string-concatenated module names, and on unexpected outbound connections from agent hosts. 6) Treat all model output and retrieved content as untrusted and require human approval for code execution tools.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionPrompt InjectionAgentFrameworkPluginAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0051- LLM Prompt Injection AML.T0053- AI Agent Tool Invocation AML.T0055- Unsecured Credentials AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate deployed AI systems

OWASP LLM Top 10

LLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-57141?

PraisonAI's TypeScript codeMode tool runs model-generated JavaScript through new Function() and with(sandbox), guarded only by a regex blocklist, and that blocklist can be bypassed with Function('return this')() and dynamically built child_process module names. Any attacker who can influence the code argument, for example through prompt injection or an exposed agent endpoint, gets operating-system command execution, file read/write and environment credential theft with the privileges of the PraisonAI process. The CVSS is 9.8 (network, low complexity, no privileges, no user interaction), but there is no CISA KEV listing, no public exploit and no Nuclei template. EPSS is low at 0.00745 (47th percentile) and CISA SSVC is TRACK*, so this is not yet actively exploited, although the bypass technique is well known and easy to reproduce. Upgrade the TypeScript package to 1.7.2 or later, and until then disable codeMode or run the agent in an isolated container with no secrets mounted. Note that the advisory references release v4.6.60, so confirm the fixed version against the GHSA before closing the ticket.

Is CVE-2026-57141 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57141, increasing the risk of exploitation.

How to fix CVE-2026-57141?

1) Upgrade the PraisonAI TypeScript package to 1.7.2 or later and verify the fix against the GHSA-p69m-4f92-2v84 advisory and commit 709a038. 2) If patching is not immediately possible, disable or remove the codeMode tool from agent configurations and tool registries. 3) Run agents in containers or VMs with a non-root user, read-only filesystem, no outbound network except required endpoints, and minimal secrets. 4) Rotate any API keys, tokens and cloud credentials that were available to exposed PraisonAI processes. 5) Detect abuse by alerting on node processes spawning shells or child processes, on tool-call logs containing Function('return this'), child_process, require or string-concatenated module names, and on unexpected outbound connections from agent hosts. 6) Treat all model output and retrieved content as untrusted and require human approval for code execution tools.

What systems are affected by CVE-2026-57141?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, code execution tools, LLM tool-calling pipelines.

What is the CVSS score for CVE-2026-57141?

CVE-2026-57141 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.74%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemscode execution toolsLLM tool-calling pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0051LLM Prompt Injection

AML.T0053AI Agent Tool Invocation

AML.T0055Unsecured Credentials

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by constructing the child_process module name dynamically. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials, and execute operating-system commands with the PraisonAI process privileges. This issue is fixed in version 1.7.2.

Exploitation Scenario

An attacker finds a PraisonAI agent that has codeMode enabled and accepts input from users or external content. They submit a prompt, or plant instructions in a web page or document the agent retrieves, that makes the agent call codeMode with JavaScript that uses Function('return this')() to reach the real global object and builds the string 'child_process' dynamically to evade the regex blocklist. The code runs in the host process, dumps environment variables containing LLM and cloud API keys, and starts a reverse shell. The attacker then pivots to connected data stores and other services using the stolen credentials.

Weaknesses (CWE)

CWE-94Improper Control of Generation of CodePrimary CWE-94Improper Control of Generation of Code

CWE-94 — Improper Control of Generation of Code: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.