Live › vulnerability › CVE-2026-57144
Go to dashboardPraisonAI's SandlockSandbox silently falls back to a weaker subprocess sandbox when Landlock is unavailable, without failing closed. Code run in that sandbox can read files outside the configured allowed path and open network connections even when network=False is set.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
pip show praisonai versions from 4.5.110 before 4.6.61 are affectedUpgrade praisonai to 4.6.61 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.
This page as .md · .json · in your agent: get_signal("CVE-2026-57144")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.