CVE-2026-57135
Summary
The published npm package praisonai exports a TypeScript SandboxExecutor with a network-isolated mode. The CLI lists that mode as:
network-isolated No network access (proxy blocked)
The implementation does not create a network namespace, firewall rule, socket filter, or proxy-enforced execution boundary. It only injects proxy environment variables into the child process:
http_proxy: 'http://localhost:0',
https_proxy: 'http://localhost:0',
HTTP_PROXY: 'http://localhost:0',
HTTPS_PROXY: 'http://localhost:0',
no_proxy: '',
NO_PROXY: ''
Clients that do not explicitly honor those proxy variables continue to use the host network stack. A local-only PoV shows that, inside mode: "network-isolated", a proxy-aware Node invocation is stopped, while a plain Node HTTP client reaches a loopback HTTP server from the same sandboxed command environment.
This is a network-isolation protection failure in an exported npm API and CLI mode. It is not a generic claim that every PraisonAI sandbox backend is affected.
Technical Details
src/praisonai-ts/src/cli/features/sandbox-executor.ts declares the mode:
export type SandboxMode = 'disabled' | 'basic' | 'strict' | 'network-isolated';
SandboxExecutor.spawn() starts the command through the host shell and passes only the environment returned by buildEnv():
const proc = spawn('sh', ['-c', command], {
cwd: this.config.cwd,
env,
timeout: this.config.timeout,
stdio: ['pipe', 'pipe', 'pipe']
});
For network-isolated, buildEnv() does not apply an OS-level network restriction. It only sets proxy variables:
case 'network-isolated':
// No network access (requires additional OS-level setup)
return {
...baseEnv,
http_proxy: 'http://localhost:0',
https_proxy: 'http://localhost:0',
HTTP_PROXY: 'http://localhost:0',
HTTPS_PROXY: 'http://localhost:0',
no_proxy: '',
NO_PROXY: ''
};
The CLI mode listing presents this as no network access:
'network-isolated': 'No network access (proxy blocked)'
That creates a false boundary. Proxy vari
⚡ Watch CVE-2026-57135
Get an email if CVE-2026-57135 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-57135)