CVE-2026-5752

CVE-2026-5752 describes a sandbox escape vulnerability found in Terrarium, an open-source Python sandbox developed by Cohere AI. This flaw allows for arbitrary code execution with root privileges on the host process. The vulnerability is exploited through JavaScript prototype chain traversal, enabling an attacker to bypass the sandbox's boundaries. Successful exploitation of CVE-2026-5752 requires local access to the system but does not necessitate user interaction or special privileges. Attackers can leverage this vulnerability to break out of the sandboxed environment and execute malicious code with elevated privileges on the underlying host system. The project is reportedly no longer actively maintained, suggesting that a patch for this vulnerability is unlikely.