All vulnerabilities
CVE-2026-57144GHSA-6jcq-6546-qrrwPYSEC-2026-3504

PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

MervinPraison PraisonAIPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in4.6.61Fixed versionOSV
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 4.6.61praisonai, PyPIOSVpip install "praisonai>=4.6.61"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.

Text from CVE List

Affected versions 52

  • PraisonAIaffected: >= 4.5.110, < 4.6.61CVE List
  • praisonai, PyPIfrom 4.5.110, fixed in 4.6.61OSV
  • praisonai, PyPI4.5.110OSV
  • praisonai, PyPI4.5.111OSV
  • praisonai, PyPI4.5.112OSV
  • praisonai, PyPI4.5.113OSV
  • praisonai, PyPI4.5.114OSV
  • praisonai, PyPI4.5.115OSV
  • praisonai, PyPI4.5.117OSV
  • praisonai, PyPI4.5.118OSV
  • praisonai, PyPI4.5.119OSV
  • praisonai, PyPI4.5.120OSV
  • praisonai, PyPI4.5.121OSV
  • praisonai, PyPI4.5.122OSV
  • praisonai, PyPI4.5.123OSV
  • praisonai, PyPI4.5.124OSV
  • praisonai, PyPI4.5.125OSV
  • praisonai, PyPI4.5.126OSV
  • praisonai, PyPI4.5.127OSV
  • praisonai, PyPI4.5.128OSV
  • praisonai, PyPI4.5.129OSV
  • praisonai, PyPI4.5.130OSV
  • praisonai, PyPI4.5.131OSV
  • praisonai, PyPI4.5.132OSV
  • praisonai, PyPI4.5.133OSV
  • praisonai, PyPI4.5.134OSV
  • praisonai, PyPI4.5.135OSV
  • praisonai, PyPI4.5.136OSV
  • praisonai, PyPI4.5.137OSV
  • praisonai, PyPI4.5.139OSV
  • praisonai, PyPI4.5.140OSV
  • praisonai, PyPI4.5.143OSV
  • praisonai, PyPI4.5.144OSV
  • praisonai, PyPI4.5.145OSV
  • praisonai, PyPI4.5.149OSV
  • praisonai, PyPI4.6.10OSV
  • praisonai, PyPI4.6.11OSV
  • praisonai, PyPI4.6.12OSV
  • praisonai, PyPI4.6.13OSV
  • praisonai, PyPI4.6.14OSV
  • praisonai, PyPI4.6.15OSV
  • praisonai, PyPI4.6.16OSV
  • praisonai, PyPI4.6.18OSV
  • praisonai, PyPI4.6.19OSV
  • praisonai, PyPI4.6.20OSV
  • praisonai, PyPI4.6.21OSV
  • praisonai, PyPI4.6.22OSV
  • praisonai, PyPI4.6.23OSV
  • praisonai, PyPI4.6.24OSV
  • praisonai, PyPI4.6.25OSV
  • praisonai, PyPI4.6.26OSV
  • praisonai, PyPI4.6.27OSV

References 1