# CVE-2026-57138: npm PraisonAI codeMode sandbox escape via Function constructor

Source: https://junglewise.ai/threats/cve-2026-57138-npm-praisonai-codemode-sandbox-escape-via-function-constructor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-57138 · Severity: critical · CVSS 9.9 · Published 2026-09-15

PraisonAI is an agent framework for Node.js that provides a code execution tool called codeMode, marketed as executing code in a sandboxed environment. However, the sandbox implementation is ineffective—attackers can use JavaScript prototype chain manipulation to escape the intended restrictions and gain access to the host process's filesystem and subprocess execution capabilities, allowing arbitrary command execution on systems running PraisonAI.

Technologies: [praisonai (npm)](https://junglewise.ai/threats/technologies/npm-praisonai). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-57138 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57138 being exploited in the wild.

**How severe is CVE-2026-57138?** Critical severity, with a CVSS score of 9.9, published 15 September 2026.

**Which products and versions are affected?** praisonai (npm) SEMVER:introduced=1.4.0,fixed=1.7.2.

**Is there a fix for CVE-2026-57138?** Yes. praisonai (npm): upgrade to 1.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57138 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57138?** Check whether you run praisonai (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonai (npm): upgrade to 1.7.2 or later

  ```sh
  npm install praisonai@1.7.2
  ```


## Technical details

The codeMode tool attempts to sandbox untrusted code by blocking direct require() calls to fs and child_process, setting process and require to undefined in a plain JavaScript object, and executing code within a with (sandbox) block using the host process's new Function constructor. However, this design fundamentally fails to create an isolation boundary. An attacker can bypass the intended restrictions by using the JavaScript prototype chain to recover the real Function constructor: ({}).constructor.constructor('return process')(). From there, process.mainModule.require exposes access to arbitrary modules, bypassing the regex-based blocklist and enabling both filesystem access and subprocess execution. The vulnerability affects versions 1.4.0 through 1.7.1; version 1.7.2 and later contain a fix. The attack requires authenticated use of the codeMode tool but can be chained with other LLM-driven code generation workflows where an attacker controls the input code.

## Affected products

- npm PraisonAI >=1.4.0, <=1.7.1

## Identifiers

- CVE-2026-57138
- GHSA-vmmj-pfw7-fjwp

## Timeline

- 2026-06-18: disclosed: GHSA-vmmj-pfw7-fjwp published
- 2026-06-18: patched: Version 1.7.2 and later patched

## References

- [https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmmj-pfw7-fjwp](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmmj-pfw7-fjwp)
- [https://github.com/MervinPraison/PraisonAI](https://github.com/MervinPraison/PraisonAI)

## Related threats

- [PraisonAI codeMode tool remote code execution via sandbox escape](https://junglewise.ai/threats/cve-2026-57141-praisonai-codemode-tool-remote-code-execution-via-sandbox-escape)
- [PraisonAI AgentLoop approval bypass via post-execution callback](https://junglewise.ai/threats/cve-2026-57137-praisonai-agentloop-approval-bypass-via-post-execution-callback)
- [PraisonAI SandboxExecutor command allowlist bypass via shell chaining](https://junglewise.ai/threats/cve-2026-57136-praisonai-sandboxexecutor-command-allowlist-bypass-via-shell)
- [PraisonAI SandboxExecutor network isolation bypass via non-proxy-aware clients](https://junglewise.ai/threats/cve-2026-57135-praisonai-sandboxexecutor-network-isolation-bypass-via-non-proxy)
- [npm PraisonAI MCPSecurity auth bypass in Basic/OAuth validation](https://junglewise.ai/threats/cve-2026-57134-npm-praisonai-mcpsecurity-auth-bypass-in-basic-oauth-validation)