# CVE-2026-40153: MervinPraison PraisonAIAgents environment variable exfiltration in shell tool

Source: https://junglewise.ai/threats/cve-2026-40153-mervinpraison-praisonaiagents-environment-variable-exfiltration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40153 · Severity: high · CVSS 7.4 · Published 2026-04-09

PraisonAIAgents is a framework for building AI agent workflows. A security flaw in its shell execution tool allows an attacker to trick the system into revealing sensitive information like database passwords and API keys stored in environment variables. This is particularly dangerous because the system's approval screen hides the fact that these secrets are being accessed, making it easy for a user to unknowingly authorize a malicious command.

Technologies: [MervinPraison PraisonAI Agents](https://junglewise.ai/threats/technologies/praisonai-agents), [Praisonaiagents](https://junglewise.ai/threats/technologies/praisonaiagents), [praisonaiagents (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonaiagents). Vendors: [MervinPraison](https://junglewise.ai/threats/vendors/mervinpraison), [Praison](https://junglewise.ai/threats/vendors/praison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-40153 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40153 being exploited in the wild.

**How severe is CVE-2026-40153?** High severity, with a CVSS score of 7.4, published 9 April 2026.

**Which products and versions are affected?** praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.128.

**Is there a fix for CVE-2026-40153?** Yes. praisonaiagents (PyPI): upgrade to 1.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40153 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40153?** Check whether you run MervinPraison PraisonAI Agents, Praisonaiagents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonaiagents (PyPI): upgrade to 1.5.128 or later

  ```sh
  pip install "praisonaiagents>=1.5.128"
  ```


## Technical details

The `execute_command` function in `shell_tools.py` uses `os.path.expandvars()` on command arguments before passing them to `subprocess.Popen`. While the system uses `shell=False` to prevent shell injection, the manual expansion of environment variables allows an attacker (potentially via prompt injection) to include references like `$DATABASE_URL` which are resolved to their literal values before execution. Furthermore, the human-in-the-loop approval system displays the unexpanded command string, leading to a 'deceptive approval' where a reviewer sees a variable name but the system executes the sensitive value. This vulnerability is fixed in version 1.5.128.

## Affected products

- MervinPraison praisonaiagents < 1.5.128

## Identifiers

- CVE-2026-40153
- GHSA-v8g7-9q6v-p3x8
- PYSEC-2026-2953

## Timeline

- 2026-04-09: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 1.5.128

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [PraisonAI SearxNG URL validation bypass in search tools](https://junglewise.ai/threats/cve-2026-57143-praisonai-server-side-request-forgery-ssrf-in-searxng-search-web)
- [PraisonAI missing access control in API endpoints](https://junglewise.ai/threats/cve-2026-57118-praisonai-agentteam-launch-exposes-unauthenticated-remote-agent)
- [PraisonAI legacy SSE endpoint CORS and authentication bypass](https://junglewise.ai/threats/cve-2026-57112-praisonai-legacy-sse-endpoint-cors-and-authentication-bypass)
- [PraisonAI IMAP injection in email tools](https://junglewise.ai/threats/cve-2026-57130-praisonai-imap-injection-in-email-tools)
- [PraisonAI path traversal in file mention parsing](https://junglewise.ai/threats/cve-2026-57129-praisonai-path-traversal-in-file-mention-parsing)