Is CVE-2026-40156 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40156 being exploited in the wild.

How severe is CVE-2026-40156?

High severity, with a CVSS score of 7.8, published 10 April 2026.

Which products and versions are affected?

praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.128.

Is there a fix for CVE-2026-40156?

Yes. praisonai (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40156 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-40156?

Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40156: PraisonAI arbitrary code execution via automatic tools.py loading

CVE-2026-40156 · Severity: high · CVSS 7.8 · Published 2026-04-10

PraisonAI, a tool for managing AI agents, automatically executes code from a file named 'tools.py' if it is present in the current folder when the application starts. An attacker could trick a user into downloading a malicious project folder or submitting a malicious file to a shared environment, leading to full control over the user's system or CI/CD pipeline. This poses a significant risk to developers and automated systems that process untrusted project files.

Technologies: Praisonai, praisonai (PyPI). Vendors: Praison, PyPI.

Quick answers

Is CVE-2026-40156 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40156 being exploited in the wild.
How severe is CVE-2026-40156?: High severity, with a CVSS score of 7.8, published 10 April 2026.
Which products and versions are affected?: praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.128.
Is there a fix for CVE-2026-40156?: Yes. praisonai (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40156 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-40156?: Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonai (PyPI): upgrade to 4.5.128 or later
```
pip install "praisonai>=4.5.128"
```

Technical details

PraisonAI's ToolResolver component automatically searches for and loads a file named 'tools.py' from the current working directory (CWD) to register custom agent tools. The vulnerability exists in `src/praisonai/praisonai/tool_resolver.py` within the `_load_local_tools` method, which uses `importlib.util.spec_from_file_location` and `spec.loader.exec_module()` to import the file. Because this occurs implicitly upon startup without validation or explicit user opt-in, any code at the module level of a malicious 'tools.py' file will execute with the privileges of the PraisonAI process. This can be exploited via social engineering (e.g., malicious repository templates) or in shared environments like CI/CD pipelines. The issue is fixed in version 4.5.128.

Affected products

MervinPraison praisonai < 4.5.128

Identifiers

CVE-2026-40156
GHSA-2g3w-cpc4-chr4
PYSEC-2026-2895

Timeline

2026-04-09: disclosed: Vulnerability published by MervinPraison
2026-04-10: advisory: GitHub Advisory published and reviewed
2026-04-10: patched: Fix released in version 4.5.128

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.