CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML
Attackers can execute arbitrary code on the host by supplying malicious YAML workflow files to the PraisonAI library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40288?
CVE-2026-40288 is a critical code injection vulnerability in MervinPraison PraisonAI, published on 14 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary command and code execution through untrusted YAML files. When praisonai workflow run <file.yaml> loads a YAML file with type: job, the JobWorkflowExecutor in job_workflow.py processes steps that support run: (shell commands via subprocess.run()), script: (inline Python via exec()), and python: (arbitrary Python script execution)—all without any validation, sandboxing, or user confirmation. The affected code paths include action_run() in workflow.py and _exec_shell(), _exec_inline_python(), and _exec_python_script() in job_workflow.py. An attacker who can supply or influence a workflow YAML file (particularly in CI pipelines, shared repositories, or multi-tenant deployment environments) can achieve full arbitrary command execution on the host system, compromising the machine and any accessible data or credentials. This issue has been fixed in versions 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents.
Which versions are affected by CVE-2026-40288?
6 open source packages ship an affected version, including praisonaiagents, PraisonAI and praisonai. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
praisonaiagents PyPI | All versions | 1.5.140 |
praisonaiagents PyPI | All versions | 1.5.140 |
praisonaiagents PyPI | All versions | 1.5.140 |
PraisonAI PyPI | All versions | 4.5.139 |
praisonai PyPI | All versions | 4.5.139 |
praisonai PyPI | All versions | 4.5.139 |
Products include Praison Praisonai, Praison Praisonaiagents.
How do I fix CVE-2026-40288?
Upgrade praisonaiagents to 1.5.140 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-40288 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40288 exists.
Other vulnerabilities in MervinPraison PraisonAI
- CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
- CVE-2026-41497 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI
- CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
- CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
- CVE-2026-34935 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Sources
Also known as GHSA-vc46-vw85-3wvm, PYSEC-2026-477, PYSEC-2026-488.