Cohere's Terrarium AI code sandbox has a root-level escape with no patch coming (CVE-2026-5752, CVSS 9.3)

A critical sandbox-escape flaw in Cohere AI's open-source Terrarium project lets code running inside the sandbox break out and execute arbitrary commands as root on the host Node.js process. Terrarium is a Python sandbox built on Pyodide (a browser- and Node.js-compatible Python distribution running in WebAssembly) and deployed as a Docker container to safely run untrusted code submitted by users or generated by a large language model. That exact use case makes the blast radius real: any AI product using Terrarium to evaluate LLM-generated Python code is giving its models a direct path to root on the container and, from there, potentially on the host. The flaw (CVE-2026-5752, CVSS 9.3) stems from JavaScript prototype chain traversal in the Pyodide WebAssembly environment: sandboxed code can reach parent and global object prototypes to manipulate objects in the host, a technique SentinelOne describes as prototype pollution bypassing the intended security boundaries. Exploitation needs local access to the sandbox but no special privileges or user interaction. The project has been starred 312 times and forked 56 times. Because Cohere is no longer actively maintaining Terrarium, the flaw is unlikely to ever be patched. Security researcher Jeremy Brown reported the issue.

Check

Search your AI and data-engineering stack for any use of Cohere's Terrarium (direct or as a dependency or fork) and identify whether user-submitted or LLM-generated code is routed through it.

Affected

All versions of Cohere AI Terrarium and any fork that inherits the Pyodide prototype traversal issue. The project is unmaintained - no patched version will be published.

Fix

Stop accepting user- or LLM-submitted code into Terrarium sandboxes. CERT/CC advises disabling any feature that submits code to Terrarium, segmenting the network so a compromised container cannot reach other services, restricting container and orchestrator access to authorized personnel, and deploying a WAF to block exploitation patterns. The only durable fix is to migrate off Terrarium to a maintained sandbox (gVisor, Firecracker, or a commercially supported code-execution service) with per-request ephemeral VMs and strict egress controls.