CVE-2026-5752: Cohere AI Terrarium Sandbox Flaw Allows Root Code Execution and Container Escape — No Patch Coming

Terrarium is a Python sandbox built by Cohere AI to run untrusted code — specifically, code submitted by users or generated by large language models — inside a containerised environment. It runs on Pyodide, a Python distribution that executes Python code through a WebAssembly runtime inside Node.js, which in theory should create multiple layers of isolation between untrusted code and the host system.

CVE-2026-5752 defeats all of those isolation layers through a JavaScript prototype chain traversal attack. In JavaScript, every object inherits from a prototype chain that ultimately reaches Object.prototype — the root of all JavaScript objects. The flaw in Terrarium's sandbox implementation is that it fails to adequately prevent sandboxed code from accessing and traversing up this prototype chain to reach parent and global object prototypes in the host environment. By manipulating these host-level objects, the attacker breaks out of Pyodide's WebAssembly sandbox boundary and gains the ability to execute code in the Node.js host process context — with root privileges.

The attack requires local access to the system — meaning the attacker must be able to submit code to the sandbox — but requires no user interaction, no authentication, and no special privileges beyond being able to reach the Terrarium endpoint. In any deployment scenario where Terrarium is used to execute user-submitted code, any user with submission access can trigger this flaw.

The consequences of successful exploitation cascade through multiple layers. First, the attacker gains root code execution inside the Docker container — the ability to run any command as the most privileged user in that environment. From there, they can read sensitive files including /etc/passwd and any secrets, credentials, or configuration files accessible within the container's filesystem. They can reach other services on the container's internal network — databases, API services, message queues — that assume container network access implies trust. And depending on the container's security configuration, they may be able to escape the container entirely and access the underlying host system.

For AI development teams, the threat model is particularly concerning. Terrarium was designed specifically for the use case of running LLM-generated code — exactly the scenario where untrusted, potentially malicious code is most likely to appear. A prompt injection attack that causes an LLM to generate a Terrarium exploit payload rather than legitimate code would execute entirely within the normal application flow, with no anomalous user behaviour to detect. The attack surface is the feature itself.

The data security and network security implications extend beyond the immediate container. Any secrets injected into the container environment — API keys, database credentials, cloud provider tokens — must be considered compromised on any system that ran user-submitted code through Terrarium. The container's network adjacency to other services means those services should be treated as potentially reachable by an attacker who has exploited this flaw.