CVE Intelligence
Analysis AI-assisted

CVE-2026-5752: Terrarium Sandbox Escape via JavaScript Prototype Chain Traversal

CVE-2026-5752 is a sandbox escape in Terrarium that, according to the published CVE description, allows arbitrary code execution with root privileges on a host process through JavaScript prototype chain traversal. The CVSS 3.1 base score reported by the CNA is 9.3 (critical), and the record is still in Awaiting Analysis status. No affected or fixed versions are listed in the sources consulted, so defenders should verify vendor guidance directly.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-5752 is a sandbox escape vulnerability in Terrarium. The CVE record was published on 2026-04-14 with CERT/CC as the CNA and is still in Awaiting Analysis status. According to the record description, JavaScript prototype chain traversal can lead to code execution with root privileges on a host process.

Impact

  • The record describes arbitrary code execution with root privileges on a host process, which is a severe outcome if untrusted code runs inside the sandbox.
  • The CVSS 3.1 vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which indicates high confidentiality, integrity and availability impact with scope change.
  • The vector reports a local attack vector with no privileges and no user interaction required. The exact conditions for exploitation are not described in the record.

Affected products and versions

  • The record does not list affected product versions or fixed versions.
  • The record references the GitHub repository cohere-ai/cohere-terrarium. Treating that repository as the affected project is an inference that should be confirmed against vendor or CERT/CC material.

Exploitation status

  • The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.
  • The EPSS probability in the record is 0.0022, which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Review the CERT/CC vulnerability note and the project repository for vendor statements, patches or workarounds, since the record provides no fix.
  • Until a verified fix is available, limit the use of Terrarium to trusted code, avoid running untrusted JavaScript in environments where the host process holds elevated privileges, and apply least privilege to host processes.
  • Isolate sandbox hosts from sensitive systems and restrict network and file access where feasible.

Detection guidance

  • Monitor host processes that run Terrarium for unexpected child processes, privilege changes, or unusual file and network activity.
  • Log and review sandbox execution requests that contain unusual object manipulation patterns, at a high level, to support incident triage.

Limitations of the available information

  • The record has no CWE classification, no affected or fixed versions, and no SSVC data.
  • The EPSS date in the record (2026-10-13) is later than the publication date and should be verified against the current EPSS feed.
  • The record does not include technical details beyond the description, so the precise exploitation conditions are unknown.

Frequently asked questions

What is CVE-2026-5752?

It is a sandbox escape vulnerability in Terrarium that, according to the CVE description, allows arbitrary code execution with root privileges on a host process through JavaScript prototype chain traversal.

Is CVE-2026-5752 being actively exploited?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

Which versions are affected and is there a fix?

The record does not list affected or fixed versions. Check the CERT/CC vulnerability note and the project repository for vendor guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.