PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to inject invalid http_proxy and https_proxy environment variables and does not establish an operating-system network boundary. Programs that ignore those proxy variables can open sockets directly, allowing supposedly isolated commands to reach localhost, internal services, cloud metadata, or external hosts and potent

CVE-2026-57135 affects PraisonAI, a multi-agent teams system, in versions 1.2.3 through 1.7.2. The SandboxExecutor's network-isolated mode fails to establish a true OS-level network boundary, relying solely on injecting invalid proxy environment variables via buildEnv(). Programs that bypass or ignore these proxy variables can open direct sockets, allowing them to reach localhost, internal services, cloud metadata endpoints, or external hosts. This misconfiguration enables potentially sensitive data exfiltration from supposedly isolated sandbox environments. The vulnerability resides in src/praisonai-ts/src/cli/features/sandbox-executor.ts. An initial remediation was released in version 1.7.2. The fix is tracked via a GitHub commit and a security advisory under GHSA-gqmf-56h7-rrpf.