{"id":"CVE-2026-57144","title":"PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable","summary":"PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native()…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-266","CWE-668","CWE-693"],"vendor":"MervinPraison","product":"PraisonAI","affected":["PraisonAI >= 4.5.110, < 4.6.61"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:07:55.583Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-57144","references":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6jcq-6546-qrrw","label":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6jcq-6546-qrrw"},{"url":"https://github.com/MervinPraison/PraisonAI"}],"tags":["cve.org","osv","pip"],"aliases":["GHSA-6jcq-6546-qrrw"],"ecosystem":"pip","patched":["praisonai 4.6.61"],"ingestedAt":"2026-07-21T19:04:56.422Z","epss":0.00123,"epssPercentile":0.02074,"slug":"CVE-2026-57144","body":"## Overview\n\nPraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.\n\n## Affected\n\n- `PraisonAI >= 4.5.110, < 4.6.61`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-57144)\n\nAffected packages:\n\n- `praisonai >= 4.5.110, < 4.6.61`\n\nPatched in:\n\n- `praisonai 4.6.61`\n\nSource: https://osv.dev/vulnerability/GHSA-6jcq-6546-qrrw","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}