CVE-2026-57141 in PraisonAI
Summary
by MITRE • 09/15/2026
PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by constructing the child_process module name dynamically. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials, and execute operating-system commands with the PraisonAI process privileges. This issue is fixed in version 1.7.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in PraisonAI versions prior to 1.7.2 represents a critical server-side code execution flaw rooted in improper handling of dynamic JavaScript evaluation within its multi-agent team system architecture. The specific weakness resides in the codeMode tool located at src/praisonai-ts/src/tools/builtins/code-mode.ts, which is designed to execute model-generated JavaScript snippets provided by users or other agents within the workflow. This functionality relies on the use of the new Function() constructor combined with a sandboxing mechanism implemented via the with statement and an associated regular-expression blocklist intended to restrict access to dangerous global objects and modules. The fundamental technical flaw lies in the assumption that static pattern matching against known malicious keywords is sufficient to prevent arbitrary code execution, ignoring the dynamic nature of JavaScript property resolution and object construction capabilities inherent to the language runtime.
The operational impact of this vulnerability is severe due to its potential for full system compromise. An attacker who can influence or inject content into the code argument passed to the codeMode tool can bypass the intended security controls through two primary techniques. First, by invoking Function('return this')(), an adversary can retrieve a reference to the global object, effectively escaping any restricted scope established by the sandboxing layer. Second, once access to the global context is obtained, the attacker can construct the name of the child_process module dynamically using string concatenation or other obfuscation techniques that evade static regular-expression detection. This allows for the instantiation of the Node.js child_process API without triggering the blocklist rules. Consequently, the attacker gains the ability to execute arbitrary operating-system commands with the same privileges as the PraisonAI process, read sensitive files from the host filesystem, write data to disk, and exfiltrate environment variables containing credentials or configuration secrets.
From a classification perspective, this vulnerability aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection), specifically involving server-side code injection via dynamic evaluation functions like new Function(). It also maps to ATT&CK technique T1059 Command and Scripting Interpreter under the Execution tactic, as it enables an attacker to leverage a scripting language for arbitrary command execution. The bypass mechanism further illustrates CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) principles where input validation is insufficient against dynamic construction patterns. The reliance on regex-based allowlists or blocklists for security-critical operations such as code sandboxing is a well-documented anti-pattern that fails to account for the expressive power and edge cases of modern JavaScript engines, leading to predictable bypasses through object prototype manipulation or indirect property access.
Mitigation strategies must prioritize architectural changes over defensive coding patterns that are prone to evasion. The immediate remediation involves upgrading PraisonAI to version 1.7.2 where this issue has been addressed by the developers. In environments where an upgrade is not immediately feasible, temporary mitigations should include disabling or restricting access to the codeMode tool entirely if it is not strictly required for business operations. If the feature must remain active, input validation should be replaced with a more robust sandboxing solution such as Node.js vm2 module configured in strict mode, which provides stronger isolation boundaries than the deprecated and easily bypassed with statement approach. Additionally, implementing Content Security Policy headers where applicable and ensuring that the application runs under least-privilege principles can limit the blast radius of any successful exploitation attempt by restricting file system access and network connectivity for the PraisonAI process account.