JavaScript Execution Vulnerability in PraisonAI Multi-Agent System

CVE-2026-57141

What is CVE-2026-57141?

PraisonAI, a multi-agent teams system, has a vulnerability in the codeMode tool which allows the execution of model-generated JavaScript using new Function() and with(sandbox). This flaw enables attackers to bypass a regular-expression blocklist by invoking Function('return this')(), thereby regaining access to the global object. By manipulating the 'code' argument, an attacker can exploit the PraisonAI process to access host capabilities, read or write files, retrieve environment credentials, and execute commands with the same privileges as the PraisonAI process. The vulnerability has been resolved in version 1.7.2.

References