CVE-2026-57141 PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
Attackers can execute arbitrary code and access host resources by bypassing sandbox restrictions in the codeMode tool of PraisonAI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57141?
CVE-2026-57141 is a critical code injection vulnerability in MervinPraison PraisonAI, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by constructing the child_process module name dynamically. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials, and execute operating-system commands with the PraisonAI process privileges. This issue is fixed in version 1.7.2.
Weakness: CWE-94
Which versions are affected by CVE-2026-57141?
2 open source packages ship an affected version, including praisonai.
| Package | Affected | Fixed in |
|---|---|---|
praisonai npm | All versions | 1.7.2 |
praisonai npm | All versions | 1.7.2 |
How do I fix CVE-2026-57141?
Upgrade praisonai to 1.7.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-57141 being exploited?
There is no known exploitation of CVE-2026-57141 in the wild and no public exploit code.
Sources
Also known as GHSA-p69m-4f92-2v84.