CVE-2026-40156 MervinPraison CVE debrief

Who should care

Users and administrators of PraisonAI, especially those who run the system in a directory where untrusted content may be present, should assess their exposure and take immediate action to prevent exploitation.

Why it matters

CVE-2026-40156 is a high-severity vulnerability in PraisonAI that allows for arbitrary code execution. Users and administrators should assess their exposure and take immediate action to prevent exploitation.

• Potential for arbitrary code execution upon startup
• Possible lateral movement and exploitation in multi-agent teams systems
• Need for immediate upgrade to version 4.5.128 or later
• Verification of working directory contents and access controls

Technical summary

The vulnerability exists due to the automatic loading of a file named tools.py from the current working directory without explicit user consent or validation. This behavior can be exploited by an attacker to execute malicious code by simply placing a malicious tools.py file in the working directory. The vulnerability is fixed in version 4.5.128. The PraisonAI system is affected by this vulnerability, and users and administrators should assess their exposure and take immediate action to prevent exploitation. The vulnerability has a high severity and requires immediate attention.

Defensive priority

High

Recommended defensive actions

• Immediately upgrade to PraisonAI version 4.5.128 or later
• Verify that no malicious tools.py files are present in the working directory
• Restrict write access to the working directory to prevent tampering
• Monitor for suspicious activity and implement additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the implicit loading of a tools.py file from the current working directory, which allows for arbitrary code execution. The vulnerability is fixed in version 4.5.128. To verify, defenders should check for the presence of a tools.py file in the working directory and ensure that it is not malicious. They should also verify that the PraisonAI system is running version 4.5.128 or later. Additionally, defenders should be aware of the potential for lateral movement and exploitation in multi-agent teams systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.