CVE-2026-40159 MervinPraison CVE debrief

Who should care

Defenders responsible for PraisonAI deployments, security teams, and developers using PraisonAI should assess their exposure and prioritize upgrading to version 4.5.128 or later. This includes reviewing affected product deployments, verifying environment configurations, and ensuring that compensating controls are in place for exposed systems. Additionally, they should restrict the use of untrusted or third-party commands in MCP to prevent potential

Why it matters

CVE-2026-40159 is a medium-severity vulnerability in PraisonAI's MCP integration that allows spawning background servers via stdio using user-supplied command strings. Defenders should prioritize upgrading to version 4.5.128 or later and restrict the use of untrusted or third-party commands in MCP to prevent potential credential exposure and supply chain attacks.

• Potential unintended credential exposure
• Possible supply chain attacks through silent exfiltration of secrets
• Risk of arbitrary code execution with access to inherited environment variables
• Need for verification of affected versions and remediation

Technical summary

The vulnerability is caused by PraisonAI's MCP integration allowing spawning background servers via stdio using user-supplied command strings. These commands are executed through Python's subprocess module, inheriting all environment variables from the host process, including sensitive data such as API keys, authentication tokens, and database credentials. This behavior introduces a security risk when untrusted or third-party commands are used, potentially leading to unintended credential exposure and supply chain attacks. The vulnerability is fixed in version 4.5.128. Further analysis indicates that defenders should prioritize upgrading to the fixed version and restrict the use of untrusted commands to prevent

Defensive priority

Defenders should prioritize upgrading to version 4.5.128 or later and restrict the use of untrusted or third-party commands in MCP. They should also assess their exposure by checking if they are using PraisonAI and if their environment allows for the execution of arbitrary commands.

Recommended defensive actions

• Upgrade to version 4.5.128 or later
• Restrict the use of untrusted or third-party commands in MCP
• Assess exposure by checking if using PraisonAI and if environment allows execution of arbitrary commands
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability, its impact, and the fixed version. A vendor advisory is also available on GitHub. Additional review indicates that defenders should verify affected PraisonAI deployments, assess exposure, and prioritize upgrading to version 4.5.128 or later. The vulnerability allows spawning background servers via stdio using user-supplied command strings, which are executed through Python's subprocess module, inheriting all environment variables from the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.