What happened
PraisonAI's 'codeMode' feature, intended to let agents run restricted JavaScript, uses a bypassable string-blocklist as its only security control around new Function()/with(sandbox), allowing full sandbox escape and arbitrary code execution on the host running the agent.
Why it matters
PraisonAI is a multi-agent orchestration framework; codeMode is specifically the tool-execution surface exposed to LLM-generated content, so an indirect prompt injection or a malicious tool response can drive the agent into escaping its sandbox and executing arbitrary code on the host — a textbook novel agent-execution attack class with a documented bypass technique.
Attack vector
codeMode executes untrusted/model-generated JavaScript with new Function() inside a with(sandbox) block, relying only on a source-code string blocklist and shadowed process/require properties. An attacker (or a prompt-injected LLM output) can construct code that bypasses the blocklist — e.g. via Function('return this')() — to recover the real global object and escape the sandbox, ultimately reaching the Node.js process and OS-level execution. A second related CVE (CVE-2026-57141) covers the same regex-blocklist bypass technique.
Affected systems
PraisonAI (praisonai-ts), versions 1.4.0 through 1.7.2
Mitigation
Upgrade PraisonAI (praisonai-ts) to 1.7.2 or later, which replaces the string-blocklist sandbox with proper isolation. Until patched, disable codeMode or restrict agent execution to trusted, non-attacker-influenced code.