CVE-2026-57138
Received Received - Intake

Code Execution via Untrusted JavaScript in PraisonAI

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist plus shadowed process and require properties. Code can use ({}).constructor.constructor to recover the real Function constructor, obtain process and process.mainModule.require, and reach host filesystem and subprocess APIs despite the advertised sandbox. Attackers who control codeMode input can read secrets, modify files, execute commands, or exhaust the host process. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-57138
EUVD
EUVD-2026-78420

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
praisonai code_mode From 1.4.0 (inc) to 1.7.2 (inc)
praisonai code_mode 1.7.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a sandbox escape flaw in the PraisonAI package versions 1.4.0 to 1.7.1. The codeMode tool uses new Function() to run untrusted JavaScript in a sandboxed environment but fails to properly isolate it. Attackers can bypass security measures by recovering the real Function constructor and accessing restricted APIs like process and require, allowing them to read files, execute commands, or manipulate the host process.

Detection Guidance

Check if PraisonAI versions 1.4.0 through 1.7.1 are installed using npm list praisonai. Inspect codeMode usage in src/praisonai-ts/src/tools/builtins/code-mode.ts for new Function() calls with untrusted input. Monitor for unusual filesystem or subprocess activity originating from PraisonAI processes.

Impact Analysis

If you use PraisonAI versions 1.4.0 to 1.7.1, attackers who control codeMode input could read secrets, modify files, execute commands, or crash the host process. This could lead to data breaches, system compromise, or denial of service if exploited.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data (e.g., personal or health information), leading to potential data breaches and regulatory penalties due to compromised confidentiality and integrity.

Mitigation Strategies

Upgrade PraisonAI to version 1.7.2 or later immediately. Avoid using codeMode with untrusted input. Replace new Function() with safer alternatives like vm2 or worker threads. Implement strict input validation and sandboxing for any code execution features.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart