Is CVE-2026-40153 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40153 being exploited in the wild.

How severe is CVE-2026-40153?

High severity, with a CVSS score of 7.4, published 9 April 2026.

Which products and versions are affected?

praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.128.

Is there a fix for CVE-2026-40153?

Yes. praisonaiagents (PyPI): upgrade to 1.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40153 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40153?

Check whether you run MervinPraison PraisonAI Agents, Praisonaiagents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40153: MervinPraison PraisonAIAgents environment variable exfiltration in shell tool

CVE-2026-40153 · Severity: high · CVSS 7.4 · Published 2026-04-09

PraisonAIAgents is a framework for building AI agent workflows. A security flaw in its shell execution tool allows an attacker to trick the system into revealing sensitive information like database passwords and API keys stored in environment variables. This is particularly dangerous because the system's approval screen hides the fact that these secrets are being accessed, making it easy for a user to unknowingly authorize a malicious command.

Technologies: MervinPraison PraisonAI Agents, Praisonaiagents, praisonaiagents (PyPI). Vendors: MervinPraison, Praison, PyPI.

Quick answers

Is CVE-2026-40153 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40153 being exploited in the wild.
How severe is CVE-2026-40153?: High severity, with a CVSS score of 7.4, published 9 April 2026.
Which products and versions are affected?: praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.128.
Is there a fix for CVE-2026-40153?: Yes. praisonaiagents (PyPI): upgrade to 1.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40153 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40153?: Check whether you run MervinPraison PraisonAI Agents, Praisonaiagents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonaiagents (PyPI): upgrade to 1.5.128 or later
```
pip install "praisonaiagents>=1.5.128"
```

Technical details

The `execute_command` function in `shell_tools.py` uses `os.path.expandvars()` on command arguments before passing them to `subprocess.Popen`. While the system uses `shell=False` to prevent shell injection, the manual expansion of environment variables allows an attacker (potentially via prompt injection) to include references like `$DATABASE_URL` which are resolved to their literal values before execution. Furthermore, the human-in-the-loop approval system displays the unexpanded command string, leading to a 'deceptive approval' where a reviewer sees a variable name but the system executes the sensitive value. This vulnerability is fixed in version 1.5.128.

Affected products

MervinPraison praisonaiagents < 1.5.128

Identifiers

CVE-2026-40153
GHSA-v8g7-9q6v-p3x8
PYSEC-2026-2953

Timeline

2026-04-09: disclosed
2026-04-10: advisory
2026-04-10: patched: Fixed in version 1.5.128

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.