This vulnerability (CVE-2026-5752) in Cohere's cohere-terrarium involves improper control of code generation (CWE-94) that leads to sandbox escape via JavaScript prototype chain traversal. Exploiting this flaw allows an attacker to execute arbitrary code with root privileges on the host process. The issue affects all versions of the product. No official patch or remediation level has been published yet, and no known exploits have been reported. The vulnerability is categorized under CWE-94 (Code Injection), CWE-400 (Resource Exhaustion), and CWE-284 (Improper Access Control).

Successful exploitation results in arbitrary code execution with root privileges on the host system, effectively compromising the entire host environment where cohere-terrarium is running. This can lead to full system compromise, unauthorized access, and control over sensitive data and resources. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/414811 for current remediation guidance. Until an official fix is released, restrict access to the affected system and monitor for suspicious activity related to cohere-terrarium. Avoid running untrusted code within the affected environment. Follow vendor updates closely for patches or official mitigations.