CVE-2026-57135
Received Received - Intake

Sandbox Network Isolation Bypass in PraisonAI

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to inject invalid http_proxy and https_proxy environment variables and does not establish an operating-system network boundary. Programs that ignore those proxy variables can open sockets directly, allowing supposedly isolated commands to reach localhost, internal services, cloud metadata, or external hosts and potentially exfiltrate data. An initial remediation was released in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-57135
EUVD
EUVD-2026-78418

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
praisonai praisonai From 1.2.3 (inc) to 1.7.2 (inc)
mervinpraison praisonai From 1.2.3 (inc) to 1.7.2 (exc)
mervinpraison praisonai 1.7.2
mervinpraison praisonai 4.6.60

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-653 The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57135 is a vulnerability in PraisonAI versions 1.2.3 to 1.7.1 where the SandboxExecutor's network-isolated mode fails to enforce actual network restrictions. It only sets invalid proxy environment variables (http_proxy, https_proxy) to http://localhost:0, which does not block network access. Programs ignoring these proxy settings can still open direct network sockets, bypassing the intended isolation.

Detection Guidance

To detect this vulnerability, check if PraisonAI versions between 1.2.3 and 1.7.1 are installed. Inspect environment variables for http_proxy or https_proxy set to localhost:0 in sandbox-executor.ts. Monitor network traffic from sandboxed processes to detect unauthorized external connections.

Impact Analysis

This vulnerability allows supposedly isolated commands to reach localhost, internal services, cloud metadata, or external hosts. Attackers could exfiltrate data, access sensitive internal resources, or make unauthorized network requests, potentially compromising confidentiality, integrity, and availability of systems using PraisonAI.

Mitigation Strategies

Upgrade PraisonAI to version 1.7.2 or later. Disable network-isolated mode if using older versions. Implement OS-level network restrictions like firewalls or network namespaces. Strip proxy environment variables in sandbox configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57135. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart