npm PraisonAI codeMode sandbox escape via Function constructor
- Product
- praisonai
- CVE
- CVE-2026-57138
- Affected
- praisonai 1.4.0 to 1.7.1
- Fixed in
- 1.7.2
Last verified against sources: October 26, 2026
Am I affected?
praisonai: affected praisonai 1.4.0 to 1.7.1. Fixed in 1.7.2.
- Check your version: run
npm ls praisonai. Versions >= 1.4.0, <= 1.7.1 of praisonai are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install praisonai@1.7.2(first patched version 1.7.2). [1] - Disable or clearly mark npm
codeModeas unsafe until a real isolation boundary exists. [1] - Do not rely on
node:vmalone for untrusted code. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- The published npm package
praisonaiexports a TypeScript built-in tool namedcodeMode. [1] - The implementation does not create an isolation boundary. [1]
- Code inside
codeModecan use the JavaScript prototype chain to recover the realFunctionconstructor. [1] - The tool is reachable through the public npm SDK. [1]
Impact
- An attacker who can supply code to
codeModecan escape the advertised sandbox and execute with the privileges of the Node.js PraisonAI process. [1] - An attacker can read process environment variables, including API keys and service tokens. [1]
- An attacker can spawn subprocesses with
child_process. [1] - An attacker can write or modify files through host filesystem APIs. [1]
What was done
Sources
- GHSA-vmmj-pfw7-fjwp — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-57138] npm PraisonAI codeMode sandbox escape via Function constructor
Product: praisonai | Affected: praisonai 1.4.0 to 1.7.1 | Fixed in: 1.7.2
Summary: The published npm package `praisonai` exports a TypeScript built-in tool named `codeMode`.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/06/cve-2026-57138-praisonaiCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-57138
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.