CVE-2026-57141: PraisonAI's codeMode tool sandbox can be escaped to run OS commands
In the praisonai npm package up to 1.7.1, the codeMode tool runs model-generated JavaScript with new Function() and a regex blocklist that's easy to bypass. Anyone who can influence that code, for example through prompt injection, can read files, steal credentials and run OS commands. Fixed in 1.7.2.
What it is
src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox). The regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by building the child_process module name dynamically.
An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials and execute operating-system commands with the PraisonAI process's privileges.
How to check
- Affected: praisonai (npm) 1.7.1 and earlier, if agents use the codeMode tool.
How to fix
- Upgrade the praisonai npm package to 1.7.2 or later.
- Treat model-generated code as untrusted and run agents that execute code in an isolated container without secrets in the environment.
npm ls praisonai