CVE-2026-57138
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist plus shadowed process and require properties. Code can use ({}).constructor.constructor to recover the real Function constructor, obtain process and process.mainModule.require, and reach host filesystem and subprocess APIs despite the advertised sandbox. Attackers who control codeMode input can read secrets, modify files, execute commands, or exhaust the host process. This issue is fixed in version 1.7.2.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.39%
- CWE
- CWE-184, CWE-693
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- MervinPraison PraisonAI
Weakness type
Related vulnerabilities
- CVE-2024-5217 — Incomplete Input Validation in GlideExpression Script
- CVE-2026-49869 — Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
- CVE-2026-33396 — OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe
- CVE-2026-28363 — In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviation
- CVE-2026-28783 — Craft has a Twig Function Blocklist Bypass
- CVE-2023-45133 — Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
- CVE-2026-32940 — SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)
- CVE-2025-58361 — Promptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVG