CVE-2026-40287 Details
Description
PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py (import_tools_from_file()), tool_resolver.py (_load_local_tools()), and CLI tool-loading paths blindly import ./tools.py at startup without any validation, sandboxing, or user confirmation. An attacker who can place a malicious tools.py in the directory where PraisonAI is launched (such as through a shared project, cloned repository, or writable workspace) achieves immediate arbitrary Python code execution in the host environment. This compromises the full PraisonAI process, the host system, and any connected data or credentials. This issue has been fixed in version 4.5.139.
A vulnerability allowing arbitrary code execution has been identified in PraisonAI versions 4.5.138 and prior. The issue arises from the automatic import of a tools.py file from the current working directory, without proper validation or user confirmation. This unsanitized import occurs in several components, including call.py and tool_resolver.py, as well as through CLI tool-loading paths. An attacker can exploit this vulnerability by placing a malicious tools.py file in the directory where PraisonAI is launched, such as through a shared project or writable workspace. Once the malicious tools.py is imported, it executes arbitrary Python code in the host environment, compromising the entire PraisonAI process, the host system, and any connected data or credentials.
Users can upgrade to PraisonAI version 4.5.139 or later to address this vulnerability. For PraisonAI Agents, version 1.5.140 or later is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g985-wjh9-qxxc | CISA-ADP | ExploitVendor Advisory |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g985-wjh9-qxxc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-426 | Untrusted Search Path | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| praison praisonai | < 4.5.139 |
CPE
Remediation
| |
| praison praisonaiagents | < 1.5.140 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | CVE Modified | CISA-ADP |
| Apr 14, 2026 | New CVE Received | [email protected] |