{"id":"CVE-2026-57144","kind":"vulnerability","aliases":["CVE-2026-57144"],"related":[],"title":"PraisonAI: sandbox fallback lets untrusted code read files and network","description":"PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.","summary":"PraisonAI's SandlockSandbox silently falls back to a weaker subprocess sandbox when Landlock is unavailable, without failing closed. Code run in that sandbox can read files outside the configured allowed path and open network connections even when network=False is set.","severity":"high","cvss":8.8,"epss":0.00157,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","linux","praisonai","python","self-hosted"],"not_affected_if":["landlock-available","sandbox-not-used","sandlock-not-installed","version-4.6.61-or-later"],"how_to_check":"Check the installed praisonai version (for example with pip show praisonai); versions from 4.5.110 before 4.6.61 are affected. Check whether the optional sandlock module imports and reports Landlock as unavailable on the host.","fix":"Upgrade praisonai to 4.6.61 or later.","status":"open","published_at":"2026-10-23T13:17:11+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:11+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.75,"triage":{"at":"2026-10-23T22:31:11Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade praisonai to 4.6.61 or later.","reach":"unknown","title":"PraisonAI: sandbox fallback lets untrusted code read files and network","impact":"medium","summary":"PraisonAI's SandlockSandbox silently falls back to a weaker subprocess sandbox when Landlock is unavailable, without failing closed. Code run in that sandbox can read files outside the configured allowed path and open network connections even when network=False is set.","category":"ai-tooling","who_cares":["praisonai","python","linux","self-hosted"],"confidence":0.75,"needs_auth":"unknown","worst_case":"Sandboxed code reads files outside the allowed path and opens network connections despite policy.","analyst_note":"","how_to_check":"Check the installed praisonai version (for example with pip show praisonai); versions from 4.5.110 before 4.6.61 are affected. Check whether the optional sandlock module imports and reports Landlock as unavailable on the host.","needs_analyst":false,"not_affected_if":["version-4.6.61-or-later","sandlock-not-installed","landlock-available","sandbox-not-used"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000997,"input_tokens":3084,"output_tokens":1378,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-57144':13A,16A '4.5.110':77C '4.6.61':81C,187C 'agent':72C 'ai':18B 'ai-tool':17B 'allow':55B,103C,171C 'back':31B,134C 'backend':93C 'boundari':158C 'caller':101C 'close':43B,130C 'code':6A,44B,96C,160C 'command':126C 'configur':54B,102C,170C 'connect':60B,176C 'cve':11A,14A 'despit':177C 'document':84C 'enforc':91C,152C 'even':61B 'execut':161C 'fail':42B,129C 'fall':30B,133C 'fallback':3A,139C 'fals':64B,108C,179C 'file':8A,51B,167C 'filesystem':104C,155C 'high':144C 'high-level':143C 'host':25B 'implement':86C 'import':116C 'issu':181C 'keep':140C 'kernel':90C 'kernel-enforc':89C 'landlock':38B,120C 'let':4A,100C 'level':145C 'linux':20B 'modul':115C 'multi':71C 'multi-ag':70C 'nativ':146C,154C 'network':10A,59B,63B,107C,157C,175C,178C 'object':148C 'open':58B,174C 'option':113C 'outsid':52B,168C 'patch':184C 'path':56B,99C,105C,172C 'payload':164C 'polici':147C 'praisonai':1A,21B,26B,67C 'praisonai.sandbox.sandlocksandbox':82C 'python':22B 'read':7A,50B,166C 'report':118C 'run':45B,125C 'sandbox':2A,36B,48B,92C,163C 'sandboxconfig.native':98C 'sandlock':114C 'sandlocksandbox':28B 'sandlocksandbox.execute':123C 'self':24B 'self-host':23B 'self.config':137C 'set':66B 'silent':29B,132C 'subprocess':35B 'subprocesssandbox':136C 'system':74C,110C 'team':73C 'tool':19B 'unavail':40B,122C 'untrust':5A,95C 'version':76C,80C,186C 'weaker':34B 'without':41B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57144","severity":null,"published_at":"2026-10-23T13:17:11+00:00","modified_at":"2026-10-23T13:17:11+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-57144","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57144","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}