# CVE-2026-57141: PraisonAI codeMode tool remote code execution via sandbox escape

Source: https://junglewise.ai/threats/cve-2026-57141-praisonai-codemode-tool-remote-code-execution-via-sandbox-escape  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-57141 · Severity: critical · CVSS 9.8 · Published 2026-09-15

PraisonAI's codeMode tool allows AI agents to execute code for task automation. An attacker can craft malicious prompts that break out of the sandbox isolation and execute arbitrary commands on the server with full system access, including file theft, credential exfiltration, and installing backdoors.

Technologies: [praisonai (npm)](https://junglewise.ai/threats/technologies/npm-praisonai). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-57141 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57141 being exploited in the wild.

**How severe is CVE-2026-57141?** Critical severity, with a CVSS score of 9.8, published 15 September 2026.

**Which products and versions are affected?** praisonai (npm) SEMVER:introduced=0,fixed=1.7.2.

**Is there a fix for CVE-2026-57141?** Yes. praisonai (npm): upgrade to 1.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57141 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-57141?** Check whether you run praisonai (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonai (npm): upgrade to 1.7.2 or later

  ```sh
  npm install praisonai@1.7.2
  ```


## Technical details

The vulnerability is an unsafe code execution in the codeMode tool (src/praisonai-ts/src/tools/builtins/code-mode.ts), which uses JavaScript's new Function() with a with(sandbox) pattern to execute LLM-generated code. The with statement does not isolate the scope—attackers can bypass it via Function('return this')() to recover the global object and access require(), then evade the regex blocklist by breaking apart module names via string concatenation (e.g., require('child_' + 'process')). The blocklist patterns are incomplete and do not cover Function constructors or prototype access. An attacker who can influence prompts to the AI agent achieves full RCE as the process user. The fix requires replacing the with(sandbox) + blocklist pattern with proper VM isolation (vm.createContext or isolated-vm) or subprocess execution with resource limits.

## Affected products

- Mervin Praison PraisonAI <=1.7.1

## Identifiers

- CVE-2026-57141
- GHSA-p69m-4f92-2v84

## Timeline

- 2026-06-18: disclosed
- 2026-06-18: patched: Patch available in version 1.7.2 or later

## References

- [https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p69m-4f92-2v84](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p69m-4f92-2v84)
- [https://github.com/MervinPraison/PraisonAI](https://github.com/MervinPraison/PraisonAI)

## Related threats

- [npm PraisonAI codeMode sandbox escape via Function constructor](https://junglewise.ai/threats/cve-2026-57138-npm-praisonai-codemode-sandbox-escape-via-function-constructor)
- [PraisonAI AgentLoop approval bypass via post-execution callback](https://junglewise.ai/threats/cve-2026-57137-praisonai-agentloop-approval-bypass-via-post-execution-callback)
- [PraisonAI SandboxExecutor command allowlist bypass via shell chaining](https://junglewise.ai/threats/cve-2026-57136-praisonai-sandboxexecutor-command-allowlist-bypass-via-shell)
- [PraisonAI SandboxExecutor network isolation bypass via non-proxy-aware clients](https://junglewise.ai/threats/cve-2026-57135-praisonai-sandboxexecutor-network-isolation-bypass-via-non-proxy)
- [npm PraisonAI MCPSecurity auth bypass in Basic/OAuth validation](https://junglewise.ai/threats/cve-2026-57134-npm-praisonai-mcpsecurity-auth-bypass-in-basic-oauth-validation)