CVE-2026-57144 Details
Description
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.
A vulnerability exists in PraisonAI versions 4.5.110 prior to 4.6.61, within the SandlockSandbox component, which is intended to provide a secure, kernel-enforced environment for executing untrusted code. When the optional sandlock module is present but Landlock support is unavailable, the sandbox does not properly enforce filesystem or network restrictions. Instead, it silently reverts to a less secure subprocess execution method that ignores the configured boundaries. This flaw allows sandboxed code to access files outside of the designated paths and to establish network connections, contrary to the intended safeguards.
Users can update to PraisonAI version 4.6.61 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6jcq-6546-qrrw | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6jcq-6546-qrrw | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MervinPraison PraisonAI | >= 4.5.110, <= 4.6.58 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |