{"id":"CVE-2026-57144","aliases":[],"cve":{"records":[{"id":"CVE-2026-57144","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-24T01:45:48.697Z","published":"2026-10-23T12:07:55.583Z","modified":"2026-10-29T02:55:07.333Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-23T12:07:55.583Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T02:55:07.333Z"}],"references":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6jcq-6546-qrrw","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6jcq-6546-qrrw","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-266","description":"CWE-266: Incorrect Privilege Assignment","source":"GitHub_M"},{"id":"CWE-668","description":"CWE-668: Exposure of Resource to Wrong Sphere","source":"GitHub_M"},{"id":"CWE-693","description":"CWE-693: Protection Mechanism Failure","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T02:54:46.036104Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.","score":8.8,"severity":"high","published":"2026-10-23T12:07:55.583Z","modified":"2026-10-29T02:55:07.333Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"MervinPraison","name":"PraisonAI","platforms":[],"versions":[{"version":">= 4.5.110, < 4.6.61","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-57144"}],"remediation":[],"references":["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6jcq-6546-qrrw"],"sources":[{"name":"CVE","id":"CVE-2026-57144","modified":"2026-10-29T02:55:07.333Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-57144"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8}],"sourceAffected":[],"observedAt":"2026-10-29T14:40:20.714Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T12:15:32.680Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T05:40:36.316Z","attemptedAt":"2026-10-29T05:40:36.316Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T05:40:35.370Z","attemptedAt":"2026-10-29T05:40:35.370Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-29T05:40:34.883Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T05:40:35.132Z","attemptedAt":"2026-10-29T05:40:35.132Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-57144","url":"https://www.first.org/epss/","probability":0.00123,"percentile":0.02074,"date":"2026-10-28","checkedAt":"2026-10-29T05:40:35.132Z"},{"source":"GitHub Advisory Database","id":"GHSA-6jcq-6546-qrrw","url":"https://github.com/advisories/GHSA-6jcq-6546-qrrw","modified":"2026-07-20T21:28:20Z","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-29T05:40:35.370Z"},{"source":"NVD","id":"CVE-2026-57144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57144","modified":"2026-10-29T04:18:39.320","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-29T05:40:36.316Z"}],"aiSummary":{"text":"PraisonAI versions 4.5.110 to 4.6.61 have a vulnerability where SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable, allowing a sandboxed payload to access files and network connections outside configured boundaries. The issue occurs when the sandlock module reports Landlock as unavailable. This affects the sandbox's ability to enforce filesystem and network boundaries.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:55:34.516Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-57144"}]}}