{"vulnerability": "CVE-2026-57138", "sightings": [{"uuid": "d96fb121-d3c9-4d20-ad31-fb4745a6dc9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57138", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmmj-pfw7-fjwp", "content": "", "creation_timestamp": "2026-07-20T22:36:02.049865Z"}, {"uuid": "7ee51fc1-cdfc-4551-bf56-0a6665cdf7cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57138", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvklo3gxse2y", "content": "\ud83d\udea8 CVE-2026-57138 \u2014 CVSS 9.9 CRITICAL\n\nPraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/bui...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-57138\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T12:08:21.354217Z"}, {"uuid": "a7be5749-9238-41f0-8e0e-d7aa6abef5b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57138", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvl3xsfimc2t", "content": "CVE-2026-57138 - praisonai\nVersions of PraisonAI from 1.4.0 through 1.7.1 run user\u2011provided JavaScript in a weak isolation that can be bypassed. An attacker could read confidential files, change data\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #CVE #infosec", "creation_timestamp": "2026-09-15T17:00:07.665066Z"}, {"uuid": "4bf072bc-527d-4a05-9404-2c0d084ab6d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57138", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvmdnemcih25", "content": "CVE-2026-57138 - praisonai\nVersions 1.4.0 through 1.7.1 of PraisonAI allow code entered into the codeMode feature to break out of its sandbox and run arbitrary commands on the server. An\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #npm #CVE #infosec", "creation_timestamp": "2026-09-16T04:50:06.956200Z"}]}