CVE-2026-5752: CWE-94 Improper Control of Generation of Code ('Code Injection') in Cohere cohere-terrarium
Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.
AI Analysis
Technical Summary
This vulnerability in cohere-terrarium 1.0.1 enables an attacker to escape the sandbox environment and execute arbitrary code as root on the host system. The attack vector involves traversing the JavaScript prototype chain, leading to improper code generation control (CWE-94). The vulnerability also implicates resource exhaustion and privilege issues (CWE-400 and CWE-284). The CVSS v3.1 score is 9.3 (critical), reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been published by the vendor, and the product is not a cloud service.
Potential Impact
Successful exploitation results in arbitrary code execution with root privileges on the host, compromising system confidentiality, integrity, and availability. This could allow full control over the affected system. The vulnerability affects only version 1.0.1 of cohere-terrarium. There are no known active exploits currently reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/414811 for current remediation guidance. Until an official fix is available, avoid using version 1.0.1 of cohere-terrarium in sensitive environments or apply any recommended temporary mitigations from the vendor advisory. Monitor the vendor advisory for updates on patches or workarounds.
CVE-2026-5752: CWE-94 Improper Control of Generation of Code ('Code Injection') in Cohere cohere-terrarium
Description
Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.
CVSS v3.1
Score 9.3critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in cohere-terrarium 1.0.1 enables an attacker to escape the sandbox environment and execute arbitrary code as root on the host system. The attack vector involves traversing the JavaScript prototype chain, leading to improper code generation control (CWE-94). The vulnerability also implicates resource exhaustion and privilege issues (CWE-400 and CWE-284). The CVSS v3.1 score is 9.3 (critical), reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been published by the vendor, and the product is not a cloud service.
Potential Impact
Successful exploitation results in arbitrary code execution with root privileges on the host, compromising system confidentiality, integrity, and availability. This could allow full control over the affected system. The vulnerability affects only version 1.0.1 of cohere-terrarium. There are no known active exploits currently reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/414811 for current remediation guidance. Until an official fix is available, avoid using version 1.0.1 of cohere-terrarium in sensitive environments or apply any recommended temporary mitigations from the vendor advisory. Monitor the vendor advisory for updates on patches or workarounds.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- certcc
- Date Reserved
- 2026-04-07T16:13:06.702Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://kb.cert.org/vuls/id/414811","vendor":"CERT"}]
Threat ID: 69de849e82d89c981fdf5f7c
Added to database: 4/14/2026, 6:17:02 PM
Last enriched: 4/29/2026, 11:04:58 AM
Last updated: 5/29/2026, 2:06:19 PM
Views: 196
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.