CVE-2026-40288 MervinPraison CVE debrief

Who should care

Defenders responsible for PraisonAI deployments, particularly those using CI pipelines, shared repositories, or multi-tenant deployment environments, should assess exposure and apply patches.

Why it matters

CVE-2026-40288 is a critical vulnerability in PraisonAI that allows for arbitrary command and code execution through untrusted YAML files, posing a significant risk to deployments, particularly in CI pipelines, shared repositories, or multi-tenant environments.

• Potential for full arbitrary command execution on the host system
• Compromise of the machine and accessible data or credentials
• Need for verification of affected versions and remediation status
• Potential disruption of critical systems and services

Technical summary

The vulnerability is caused by the lack of validation, sandboxing, or user confirmation in the workflow engine, which processes steps that support run: (shell commands via subprocess.run()), script: (inline Python via exec()), and python: (arbitrary Python script execution). This allows for arbitrary command and code execution through untrusted YAML files, affecting PraisonAI versions below 4.5.139 and praisonaiagents versions below 1.5.140, with a high impact on deployments, particularly in CI pipelines, shared repositories, or multi-tenant environments.

Defensive priority

High priority for defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure by checking if PraisonAI versions below 4.5.139 or praisonaiagents versions below 1.5.140 are in use
• Apply patches to upgrade to PraisonAI version 4.5.139 or later and praisonaiagents version 1.5.140 or later
• Review and restrict access to workflow YAML files to prevent supply or influence by unauthorized parties
• Monitor for suspicious activity and implement compensating controls to detect potential exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the lack of validation, sandboxing, or user confirmation in the workflow engine, which processes steps that support run: (shell commands via subprocess.run()), script: (inline Python via exec()), and python: (arbitrary Python script execution).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.