CVE-2026-57138 in PraisonAI
Summary
by MITRE • 09/15/2026
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist plus shadowed process and require properties. Code can use ({}).constructor.constructor to recover the real Function constructor, obtain process and process.mainModule.require, and reach host filesystem and subprocess APIs despite the advertised sandbox. Attackers who control codeMode input can read secrets, modify files, execute commands, or exhaust the host process. This issue is fixed in version 1.7.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in PraisonAI versions ranging from 1.4.0 to 1.7.2 represents a critical failure in sandbox isolation mechanisms within its multi-agent team system architecture. The core of the flaw resides in the codeMode component located at src/praisonai-ts/src/tools/builtins/code-mode.ts, which is responsible for executing user-supplied JavaScript snippets. Instead of employing robust execution environments such as Node.js vm modules with strict context separation or external process isolation, the implementation utilizes the global Function constructor to dynamically create and execute functions within a limited sandbox scope. This approach fundamentally undermines security because it relies on language-level features that are inherently difficult to restrict completely when arbitrary code execution is permitted. The system attempts to mitigate risks by shadowing dangerous properties such as require and process, and maintaining a small source-code blocklist, but these measures prove insufficient against determined attackers capable of exploiting JavaScript prototype chain manipulation techniques.
The technical mechanism enabling this exploitation involves the recovery of the original Function constructor through standard JavaScript object introspection methods. By accessing the constructor property of an empty object literal, specifically using syntax like ({}).constructor.constructor, an attacker can bypass the shadowed global variables and retrieve the unmodified Function constructor from the outer scope. Once the real Function constructor is obtained, it allows for the creation of new functions that have access to the full Node.js environment rather than the restricted sandbox context. This effectively neutralizes the intended isolation boundaries, granting the executed code unrestricted access to critical modules such as process and module.require. Consequently, the attacker can invoke internal APIs that interact with the host operating system, including file system operations and subprocess execution capabilities, which were explicitly supposed to be blocked by the sandbox configuration.
The operational impact of this vulnerability is severe, allowing attackers who control the input passed to codeMode to achieve arbitrary command execution on the underlying host machine. This capability enables a range of malicious activities, including reading sensitive secrets stored in environment variables or configuration files, modifying system or application files to persist malware or alter behavior, and executing shell commands that can compromise the integrity of the entire infrastructure. Furthermore, an attacker could exhaust host resources by spawning numerous subprocesses or performing intensive computations, leading to denial-of-service conditions for other users sharing the same instance. The ability to read secrets poses a significant risk as PraisonAI often handles API keys, database credentials, and authentication tokens necessary for its multi-agent operations, making this vulnerability a direct pathway to broader system compromise.
This issue aligns with CWE-94 Improper Control of Generation of Code or Command, specifically highlighting the dangers of using dynamic code evaluation features like eval or Function constructors without adequate safeguards. It also maps closely to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as well as T1203 Exploitation for Client Execution, since the vulnerability allows an attacker to leverage a trusted application component to execute arbitrary commands on the victim system. The reliance on blocklists is particularly problematic because it follows the principle of allowing all unless explicitly denied, which is known to be brittle and easily bypassed through novel JavaScript techniques or encoded payloads that evade simple string matching.
The recommended mitigation strategy involves upgrading immediately to version 1.7.2 where this vulnerability has been addressed by replacing unsafe dynamic execution methods with secure alternatives such as the Node.js vm module configured in a strict sandbox mode, ensuring proper context isolation and disabling access to global objects like process and require unless absolutely necessary for specific trusted operations. In addition to patching, organizations should implement defense-in-depth measures including running PraisonAI instances within containerized environments or virtual machines with restricted permissions, applying least-privilege principles to file system access, and monitoring for unusual subprocess creation patterns that may indicate exploitation attempts. Input validation should also be strengthened by rejecting any code snippets containing suspicious patterns such as constructor chains or prototype manipulations before they reach the execution engine, although this serves only as a supplementary control rather than a primary fix given the complexity of JavaScript parsing rules.