{"schema":"threatline.record/2","record":{"id":"CVE-2026-57144","aliases":["GHSA-6jcq-6546-qrrw","PYSEC-2026-3504"],"summary":"PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable","details":"PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.","categories":["Libraries & packages"],"product":"PraisonAI","vendor":"MervinPraison","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57144","source_modified_at":"2026-10-23T12:07:55.583Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"PraisonAI","vendor":"MervinPraison","versions":[{"version":">= 4.5.110, < 4.6.61","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6jcq-6546-qrrw","source_modified_at":"2026-07-23T15:11:31.783223634Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"praisonai","ecosystem":"PyPI","purl":"pkg:pypi/praisonai"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.110"},{"fixed":"4.6.61"}]}],"versions":["4.5.110","4.5.111","4.5.112","4.5.113","4.5.114","4.5.115","4.5.117","4.5.118","4.5.119","4.5.120","4.5.121","4.5.122","4.5.123","4.5.124","4.5.125","4.5.126","4.5.127","4.5.128","4.5.129","4.5.130","4.5.131","4.5.132","4.5.133","4.5.134","4.5.135","4.5.136","4.5.137","4.5.139","4.5.140","4.5.143","4.5.144","4.5.145","4.5.149","4.6.10","4.6.11","4.6.12","4.6.13","4.6.14","4.6.15","4.6.16","4.6.18","4.6.19","4.6.20","4.6.21","4.6.22","4.6.23","4.6.24","4.6.25","4.6.26","4.6.27"]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6jcq-6546-qrrw","source_modified_at":"2026-07-23T15:11:31.783223634Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"praisonai","ecosystem":"PyPI","purl":"pkg:pypi/praisonai"},"version":"4.6.61"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T12:07:55.583Z","modified_at":"2026-10-23T12:07:55.583Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-57144","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T12:07:55.583Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-6jcq-6546-qrrw","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-07-23T15:11:31.783223634Z"}],"sources":["CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6jcq-6546-qrrw","tags":["x_refsource_CONFIRM"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T12:07:55.583Z","content_hash":"7d4a1184d95598835d992f067544181c8cb4f54285160181da7ab65c8c9d3625"}}