---
id: CVE-2026-57135
title: PraisonAI is a multi-agent teams system
summary: >-
  PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2,
  SandboxExecutor network-isolated mode in
  src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to
  inject invalid http_proxy and https_proxy environment…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L'
cwe:
  - CWE-653
  - CWE-693
vendor: MervinPraison
product: PraisonAI
affected:
  - 'PraisonAI >= 1.2.3, < 1.7.2'
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T14:45:28.563'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57135'
references:
  - url: >-
      https://github.com/MervinPraison/PraisonAI/commit/709a0387853709a5e2f2c34680fa64cada252c27
    label: security-advisories@github.com
  - url: 'https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.60'
    label: security-advisories@github.com
  - url: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gqmf-56h7-rrpf
    label: security-advisories@github.com
  - url: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gqmf-56h7-rrpf
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00416
epssPercentile: 0.3324
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T12:43:08.182873Z'
ingestedAt: '2026-09-15T10:35:28.519Z'
---

## Overview

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to inject invalid http_proxy and https_proxy environment variables and does not establish an operating-system network boundary. Programs that ignore those proxy variables can open sockets directly, allowing supposedly isolated commands to reach localhost, internal services, cloud metadata, or external hosts and potentially exfiltrate data. An initial remediation was released in version 1.7.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.