CVE-2026-40159 Details
Description
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI’s MCP (Model Context Protocol) integration allows spawning background servers via stdio using user-supplied command strings (e.g., MCP("npx -y @smithery/cli ...")). These commands are executed through Python’s subprocess module. By default, the implementation forwards the entire parent process environment to the spawned subprocess. As a result, any MCP command executed in this manner inherits all environment variables from the host process, including sensitive data such as API keys, authentication tokens, and database credentials. This behavior introduces a security risk when untrusted or third-party commands are used. In common scenarios where MCP tools are invoked via package runners such as npx -y, arbitrary code from external or potentially compromised packages may execute with access to these inherited environment variables. This creates a risk of unintended credential exposure and enables potential supply chain attacks through silent exfiltration of secrets. This vulnerability is fixed in 4.5.128.
A vulnerability in PraisonAI versions through 4.5.117 allows the execution of user-supplied commands via the MCP (Model Context Protocol) integration. These commands are run in the background using Python's subprocess module, and by default, the entire parent process environment is forwarded to the spawned subprocess. This means that any executed MCP command inherits all environment variables from the host process, including sensitive information such as API keys, authentication tokens, and database credentials. The vulnerability arises when untrusted or third-party commands are used, particularly with package runners like npx -y, where arbitrary code from external packages could execute with access to these sensitive environment variables. This could lead to unintended credential exposure and enable supply chain attacks by silently exfiltrating secrets.
Users are advised to sanitize environment variable dictionaries before passing them to subprocesses, removing sensitive API keys and tokens unless explicitly whitelisted. Additionally, a strict allowlist parameter could be implemented for variables that developers intend to pass down. Documentation should also highlight the risks of using 'npx -y' with MCP tools.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pj2r-f9mw-vrcq | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-214 | Invocation of Process Using Visible Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| praison praisonai | < 4.5.128 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 10, 2026 | New CVE Received | [email protected] |