CVE-2026-57138

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...