AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-57141criticalCode execution2026-09-15

CVE-2026-57141: PraisonAI's codeMode tool sandbox can be escaped to run OS commands

In the praisonai npm package up to 1.7.1, the codeMode tool runs model-generated JavaScript with new Function() and a regex blocklist that's easy to bypass. Anyone who can influence that code, for example through prompt injection, can read files, steal credentials and run OS commands. Fixed in 1.7.2.

01.

What it is

src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox). The regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by building the child_process module name dynamically.

An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials and execute operating-system commands with the PraisonAI process's privileges.

02.

How to check

  1. Affected: praisonai (npm) 1.7.1 and earlier, if agents use the codeMode tool.
03.

How to fix

  1. Upgrade the praisonai npm package to 1.7.2 or later.
  2. Treat model-generated code as untrusted and run agents that execute code in an isolated container without secrets in the environment.
npm ls praisonai
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.