AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool? What should I do?

    The codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts uses new Function() with a with(sandbox) pattern to execute LLM-generated code.

    Affected: praisonai <= 1.7.1. Fixed in: 1.7.2. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2026-57141-praisonai-npm (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: praisonai <= 1.7.1. Fixed in: 1.7.2.

      • Check your version: run npm ls praisonai. Versions <= 1.7.1 of praisonai are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install praisonai@1.7.2 (first patched version 1.7.2).
      2. Use the vm module with proper context isolation.
      3. Or use isolated-vm for true process-level isolation with separate V8 isolates.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-57141-praisonai-npm (opens external site)

      Did this work for you?

    Add your answer or comment