Junglewise Threat Intelligence

CVE-2026-40288: MervinPraison PraisonAI RCE via job workflow YAML

CVE-2026-40288 · Severity: critical · CVSS 9.8 · Published 2026-04-10

Technologies: praisonaiagents (PyPI), praisonai (PyPI). Vendors: PyPI, MervinPraison.

Executive brief

PraisonAI, an AI agent and workflow framework, is vulnerable to a critical security flaw that allows for remote code execution. By providing a specially crafted workflow file, an attacker can force the system to execute arbitrary commands or Python scripts on the host machine. This could lead to a total takeover of the server or development environment where the software is running.

Technical details

A remote code execution (RCE) vulnerability exists in PraisonAI due to the unsafe execution of commands defined in YAML workflow files. When a workflow with 'type: job' is processed, the JobWorkflowExecutor in 'job_workflow.py' uses subprocess.run() for 'run' keys, exec() for 'script' keys, and direct execution for 'python' keys without sufficient sanitization or sandboxing. An attacker can provide a malicious YAML file to achieve arbitrary command execution on the host. The vulnerability is addressed in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140.

Affected products

  • MervinPraison PraisonAI <= 4.5.138
  • MervinPraison praisonaiagents <= 1.5.139

Timeline

  • 2026-04-10: disclosed
  • 2026-04-10: advisory
  • 2026-04-10: patched: Fixed in PraisonAI 4.5.139 and praisonaiagents 1.5.140

References

Related threats