Executive brief
PraisonAI, an AI agent framework, contains a security flaw in how it handles background tasks. When the software runs third-party tools or servers, it inadvertently shares all of the main application's secret keys and credentials with those tools. This could allow a malicious third-party package to steal sensitive information like OpenAI API keys, database passwords, or cloud access tokens.
Technical details
PraisonAI's Model Context Protocol (MCP) integration uses Python's subprocess module to spawn background servers. By default, the implementation in `mcp.py` copies the entire parent process environment (`os.environ.copy()`) and forwards it to the child process if no specific environment is provided. An attacker can exploit this by providing a malicious command string to the MCP constructor. When executed, the subprocess inherits all sensitive environment variables, such as `OPENAI_API_KEY` or database connection strings, which can then be exfiltrated to a remote server. This vulnerability is tracked as CVE-2026-40159 and is fixed in version 4.5.128.
Affected products
- MervinPraison PraisonAI < 4.5.128
Timeline
- 2026-04-09: disclosed: Vulnerability published by MervinPraison
- 2026-04-10: advisory: GitHub Advisory GHSA-pj2r-f9mw-vrcq published
- 2026-04-10: patched: Fixed in version 4.5.128