# CVE-2026-40113: PraisonAI argument injection in Cloud Run deployment

Source: https://junglewise.ai/threats/cve-2026-40113-praisonai-argument-injection-in-cloud-run-deployment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40113 · Severity: high · CVSS 8.4 · Published 2026-04-09

PraisonAI is an AI framework used to deploy autonomous agents to cloud environments. A vulnerability in its deployment script allows an attacker who can influence local configuration or environment variables to inject unauthorized settings into the production cloud service. This could lead to the theft of sensitive API keys, redirection of AI traffic to malicious servers, or full compromise of the deployed application's environment.

Technologies: [Praisonai](https://junglewise.ai/threats/technologies/praisonai), [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai). Vendors: [Praison](https://junglewise.ai/threats/vendors/praison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-40113 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40113 being exploited in the wild.

**How severe is CVE-2026-40113?** High severity, with a CVSS score of 8.4, published 9 April 2026.

**Which products and versions are affected?** praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.128.

**Is there a fix for CVE-2026-40113?** Yes. praisonai (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40113 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-40113?** Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonai (PyPI): upgrade to 4.5.128 or later

  ```sh
  pip install "praisonai>=4.5.128"
  ```


## Technical details

The `deploy.py` script in PraisonAI performs improper neutralization of argument delimiters (CWE-88) when constructing commands for the `gcloud` CLI. Specifically, it interpolates `openai_model`, `openai_key`, and `openai_base` into a single comma-delimited string for the `--set-env-vars` flag. Because `gcloud` uses commas as internal delimiters for this flag, an attacker can include a comma in any of these values to inject additional `KEY=VALUE` pairs. This allows for environment variable injection or overriding existing variables like `OPENAI_API_KEY`. The vulnerability is exploitable if an attacker can modify local environment variables, `.env` files, or CI/CD secrets used during the deployment process. The issue is fixed in version 4.5.128 by using separate `--update-env-vars` flags for each variable.

## Affected products

- MervinPraison PraisonAI < 4.5.128

## Identifiers

- CVE-2026-40113
- GHSA-fvxx-ggmx-3cjg
- PYSEC-2026-2913

## Timeline

- 2026-04-09: advisory: GitHub Advisory GHSA-fvxx-ggmx-3cjg published
- 2026-04-10: patched: Fix released in version 4.5.128

## References

- [https://api.github.com/users/aswinastro](https://api.github.com/users/aswinastro)
- [https://github.com/aswinastro](https://github.com/aswinastro)
- [https://api.github.com/users/aswinastro/gists%7B/gist_id%7D](https://api.github.com/users/aswinastro/gists%7B/gist_id%7D)
- [https://api.github.com/users/aswinastro/repos](https://api.github.com/users/aswinastro/repos)
- [https://avatars.githubusercontent.com/u/174955809?v=4](https://avatars.githubusercontent.com/u/174955809?v=4)
- [https://api.github.com/users/aswinastro/events%7B/privacy%7D](https://api.github.com/users/aswinastro/events%7B/privacy%7D)

## Related threats

- [PraisonAI authentication bypass in A2U event streaming](https://junglewise.ai/threats/cve-2026-57146-praisonai-a2u-incomplete-authentication-fix-leaves-current-serve)
- [PraisonAI sandbox escape when Landlock unavailable](https://junglewise.ai/threats/cve-2026-57144-praisonai-sandlocksandbox-falls-back-to-unrestricted-subprocess)
- [PraisonAI recipe policy bypass via YAML-approved tools](https://junglewise.ai/threats/cve-2026-57142-praisonai-recipe-workflow-policy-can-be-bypassed-by-declaring-and)
- [PraisonAI shell command injection in compute-bridged file tools](https://junglewise.ai/threats/cve-2026-57117-praisonai-compute-bridged-file-tools-allow-shell-command)
- [PraisonAI AgentOS authentication bypass in FastAPI deployment](https://junglewise.ai/threats/cve-2026-57116-praisonai-agentos-remains-unauthenticated-after-incomplete-fix)