Is CVE-2026-57138 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57138 being exploited in the wild.

How severe is CVE-2026-57138?

Critical severity, with a CVSS score of 9.9, published 15 September 2026.

Which products and versions are affected?

praisonai (npm) SEMVER:introduced=1.4.0,fixed=1.7.2.

Is there a fix for CVE-2026-57138?

Yes. praisonai (npm): upgrade to 1.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57138 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57138?

Check whether you run praisonai (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57138: npm PraisonAI codeMode sandbox escape via Function constructor

CVE-2026-57138 · Severity: critical · CVSS 9.9 · Published 2026-09-15

PraisonAI is an agent framework for Node.js that provides a code execution tool called codeMode, marketed as executing code in a sandboxed environment. However, the sandbox implementation is ineffective—attackers can use JavaScript prototype chain manipulation to escape the intended restrictions and gain access to the host process's filesystem and subprocess execution capabilities, allowing arbitrary command execution on systems running PraisonAI.

Technologies: praisonai (npm). Vendors: npm.

Quick answers

Is CVE-2026-57138 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57138 being exploited in the wild.
How severe is CVE-2026-57138?: Critical severity, with a CVSS score of 9.9, published 15 September 2026.
Which products and versions are affected?: praisonai (npm) SEMVER:introduced=1.4.0,fixed=1.7.2.
Is there a fix for CVE-2026-57138?: Yes. praisonai (npm): upgrade to 1.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57138 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57138?: Check whether you run praisonai (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonai (npm): upgrade to 1.7.2 or later
```
npm install praisonai@1.7.2
```

Technical details

The codeMode tool attempts to sandbox untrusted code by blocking direct require() calls to fs and child_process, setting process and require to undefined in a plain JavaScript object, and executing code within a with (sandbox) block using the host process's new Function constructor. However, this design fundamentally fails to create an isolation boundary. An attacker can bypass the intended restrictions by using the JavaScript prototype chain to recover the real Function constructor: ({}).constructor.constructor('return process')(). From there, process.mainModule.require exposes access to arbitrary modules, bypassing the regex-based blocklist and enabling both filesystem access and subprocess execution. The vulnerability affects versions 1.4.0 through 1.7.1; version 1.7.2 and later contain a fix. The attack requires authenticated use of the codeMode tool but can be chained with other LLM-driven code generation workflows where an attacker controls the input code.

Affected products

npm PraisonAI >=1.4.0, <=1.7.1

Identifiers

CVE-2026-57138
GHSA-vmmj-pfw7-fjwp

Timeline

2026-06-18: disclosed: GHSA-vmmj-pfw7-fjwp published
2026-06-18: patched: Version 1.7.2 and later patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.