PraisonAI SandlockSandbox: Sandbox bypass through unrestricted subprocess fallback
Summary
PraisonAI's SandlockSandbox, meant to isolate untrusted code, silently falls back to plain subprocess execution when the optional sandlock module reports that Landlock is unavailable. In that case the configured filesystem allowlist and network=False setting are not enforced. Code running in the sandbox can read files outside the allowed path and open network connections. Exploitation requires that code runs inside the sandbox, for example via an agent that processes untrusted input.
Affected
- PraisonAI >= 4.5.110, < 4.6.61 (NVD)
- GitHub advisory GHSA-6jcq-6546-qrrw lists >= 4.5.110, <= 4.6.58
- Affected only where the sandlock module is installed and Landlock is unavailable
Fixed in
- Fixed in PraisonAI 4.6.61
Workaround
- No vendor workaround known.
- Until patched, do not rely on SandlockSandbox for untrusted code.
- Check whether sandlock reports Landlock as usable on your hosts; if not, treat the sandbox as unenforced.
Exploitation
- No in-the-wild exploitation known.
- A public proof of concept is referenced in the vendor advisory.
- CISA SSVC: exploitation poc, not automatable, total technical impact.
- EPSS 0.00207.
Our recommendation
- Check the installed version with pip show praisonai.
- Upgrade to PraisonAI 4.6.61 or later; consider the latest release.
- Until patched, do not run untrusted code through SandlockSandbox.
- Restrict credentials and sensitive files accessible to hosts running agents.
- Prioritise hosts where agents process external content or hold credentials.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6jcq-6546-qrrw github.com
- NVD mirror on vulners.com: CVE-2026-57144 vulners.com
- Strix CVE page: CVE-2026-57144 www.strix.ai
- OSV: GHSA-6jcq-6546-qrrw osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:46.
Original description (NVD)
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.