Read the docs
TI-2026-29070 Aliases CVE-2026-40288GHSA-vc46-vw85-3wvm

PraisonAI: Critical RCE via `type: job` workflow YAML

Priority HIGH 82CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary command and code execution through untrusted YAML files. When praisonai workflow run <file.yaml> loads a YAML file with type: job, the JobWorkflowExecutor in job_workflow.py processes steps that support run: (shell commands via subprocess.run()), script: (inline Python via exec()), and python: (arbitrary Python script execution)—all without any validation, sandboxing, or user confirmation. The affected code paths include action_run() in workflow.py and _exec_shell(), _exec_inline_python(), and _exec_python_script() in job_workflow.py. An attacker who can supply or influence a workflow YAML file (particularly in CI pipelines, shared repositories, or multi-tenant deployment environments) can achieve full arbitrary command execution on the host system, compromising the machine and any accessible data or credentials. This issue has been fixed in versions 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00609 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed PraisonAI (MervinPraison): 4.5.139praisonaiagents (MervinPraison): 1.5.140+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MervinPraisonPraisonAIbefore 4.5.1394.5.139Patch availableCNA
MervinPraisonpraisonaiagentsbefore 1.5.1401.5.140Patch availableCNA
—praisonaiagents (PyPI)before 1.5.1401.5.140Patch availableGHSA-vc46-vw85-3wvm
—PraisonAI (PyPI)before 4.5.1394.5.139Patch availableGHSA-vc46-vw85-3wvm
  • PraisonAI VendorMervinPraison Affected before 4.5.139 Fixed in 4.5.139 Patch available CNA
  • praisonaiagents VendorMervinPraison Affected before 1.5.140 Fixed in 1.5.140 Patch available CNA
  • praisonaiagents (PyPI) Vendor— Affected before 1.5.140 Fixed in 1.5.140 Patch available GHSA-vc46-vw85-3wvm
  • PraisonAI (PyPI) Vendor— Affected before 4.5.139 Fixed in 4.5.139 Patch available GHSA-vc46-vw85-3wvm

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*before 4.5.139VulnerableMervinPraison
cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:python:*:*before 1.5.140VulnerableMervinPraison
  • cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions before 4.5.139 Vulnerable ·MervinPraison
  • cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:python:*:* Versions before 1.5.140 Vulnerable ·MervinPraison

Remediation

  • Fix · CNA PraisonAI (MervinPraison) Fixed in 4.5.139
  • Fix · CNA praisonaiagents (MervinPraison) Fixed in 1.5.140
  • Fix · GHSA-vc46-vw85-3wvm praisonaiagents (PyPI) Fixed in 1.5.140 Advisory →
  • Fix · GHSA-vc46-vw85-3wvm PraisonAI (PyPI) Fixed in 4.5.139 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40288
  2. 2026-10-03 Alias added: GHSA-vc46-vw85-3wvm
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-30083 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI CVSS 3.1CRITICAL 9.8
  • TI-2026-28940 PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API CVSS 3.1CRITICAL 10.0
  • TI-2026-28768 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading CVSS 3.1CRITICAL 9.8
  • TI-2026-27159 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() CVSS 3.1CRITICAL 9.8
  • TI-2026-27158 PraisonAI: Second-Order SQL Injection in `get_all_user_threads` CVSS 3.1CRITICAL 9.8
  • TI-2026-29071 PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions CVSS 3.1CRITICAL 9.1
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences