PT-2026-32894 · Terrarium · Terrarium

Published 2026-04-14 · Updated 2026-04-28 · CVE-2026-5752

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Terrarium (affected versions not specified)

Description A sandbox escape allows arbitrary code execution with root privileges on a host process. This is achieved through JavaScript prototype chain traversal, which enables a full container escape from the sandbox environment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-5752

Affected Products

Terrarium

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2026-5752 · Security Note
• https://github.com/cohere-ai/cohere-terrarium · Note
• https://twitter.com/TheHackersNews/status/2046851425398075793 · Twitter Post
• https://twitter.com/CVEnew/status/2044338952069673125 · Twitter Post
• https://twitter.com/nxtgen579255/status/2047115481816158346 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1ssg0xk/cohere_ai_terrarium_sandbox_flaw_enables_root · Reddit Post
• https://twitter.com/lucasverdan/status/2047251390935040193 · Twitter Post
• https://twitter.com/SocXAInvaders/status/2047246619238916553 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2046996704721764405 · Twitter Post
• https://twitter.com/TheRabbitPy/status/2048335304780616018 · Twitter Post
• https://kb.cert.org/vuls/id/414811 · Note
• https://twitter.com/Dinosn/status/2048074450260595028 · Twitter Post
• https://twitter.com/GergelyHANDO/status/2046852520627024001 · Twitter Post
• https://reddit.com/r/u_Expert_Sort7434/comments/1sws0hq/cve202633626_lmdeploy_ssrf_exploited_125_hours · Reddit Post
• https://twitter.com/fynn_JourX/status/2047254205409440147 · Twitter Post