Read the docs
TI-2026-28968 Aliases CVE-2026-40153GHSA-v8g7-9q6v-p3x8

PraisonAIAgents Affected by Environment Variable Secret Exfiltration via…

Priority HIGH 66CWE-526Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False (line 88) for security. This allows exfiltration of secrets stored in environment variables (database credentials, API keys, cloud access keys). The approval system displays the unexpanded $VAR references to human reviewers, creating a deceptive approval where the displayed command differs from what actually executes. This vulnerability is fixed in 1.5.128.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00277 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed PraisonAIAgents (MervinPraison): 1.5.128praisonaiagents (PyPI): 1.5.128

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MervinPraisonPraisonAIAgentsbefore 1.5.1281.5.128Patch availableCNA
—praisonaiagents (PyPI)before 1.5.1281.5.128Patch availableGHSA-v8g7-9q6v-p3x8
  • PraisonAIAgents VendorMervinPraison Affected before 1.5.128 Fixed in 1.5.128 Patch available CNA
  • praisonaiagents (PyPI) Vendor— Affected before 1.5.128 Fixed in 1.5.128 Patch available GHSA-v8g7-9q6v-p3x8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:*:*:*before 1.5.128VulnerableMervinPraison
  • cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:*:*:* Versions before 1.5.128 Vulnerable ·MervinPraison

Remediation

  • Fix · CNA PraisonAIAgents (MervinPraison) Fixed in 1.5.128
  • Fix · GHSA-v8g7-9q6v-p3x8 praisonaiagents (PyPI) Fixed in 1.5.128 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40153
  2. 2026-10-03 Alias added: GHSA-v8g7-9q6v-p3x8

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-29070 PraisonAI: Critical RCE via `type: job` workflow YAML CVSS 3.1CRITICAL 9.8
  • TI-2026-27162 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code CVSS 3.1CRITICAL 10.0
  • TI-2026-29071 PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions CVSS 3.1CRITICAL 9.1
  • TI-2026-32306 PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute CVSS 3.1HIGH 8.6
  • TI-2026-27178 PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL CVSS 3.1HIGH 8.6
  • TI-2026-27161 PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution CVSS 3.1CRITICAL 9.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences