CVE-2026-5752
CVSS 9.3 CRITICAL: sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via… EPSS 0.2% (11th percentile).
Vulnerabilities & Exploits
Pyodide-based sandboxes can still hand attackers host-level control. The standard response is to trust the container boundary, but CVE-2026-5752 breaks that assumption by letting code reach root privileges through JavaScript prototype traversal.
Cohere’s Terrarium sandbox is affected. CERT/CC says the flaw sits in the Pyodide WebAssembly environment and can let an attacker execute arbitrary system commands as root inside the container, access sensitive files, and potentially escape into the host Node.js process. The issue is rated CVSS 9.3 and requires only local access, not user interaction or special privileges.
The practical risk is broader than one sandbox product. Any workflow that runs untrusted or LLM-generated Python in a containerized Pyodide environment should treat the container as a weak boundary, because host compromise can follow even when the sandbox itself appears isolated.
1 source · Apr 22
CVSS 9.3 CRITICAL: sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via… EPSS 0.2% (11th percentile).
The Hacker News
Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution, Container Escape
CVE-2026-5752 CVSS 9.3 flaw in Terrarium enables root code execution via Pyodide prototype traversal, risking container escape.
originalPart of the PlainSec briefing for 2026-04-22
Every edition of this story: Containerized LLM Sandboxes Can Still Yield Host Root