What is the CVSS score of CVE-2026-40159?

CVE-2026-40159 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40159?

Yes, a patch is available for CVE-2026-40159. Update the affected software to the latest version immediately.

Python CVE-2026-40159

EUVD-2026-21511 MEDIUM

Information Exposure (CWE-200)

2026-04-10 GitHub_M

GHSA-pj2r-f9mw-vrcq

Python Information Disclosure RCE

5.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 10, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 10, 2026 - 17:15 euvd

EUVD-2026-21511

Analysis Generated

Apr 10, 2026 - 17:15 vuln.today

CVE Published

Apr 10, 2026 - 16:57 nvd

MEDIUM 5.5

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI’s MCP (Model Context Protocol) integration allows spawning background servers via stdio using user-supplied command strings (e.g., MCP("npx -y @smithery/cli ...")). These commands are executed through Python’s subprocess module. By default, the implementation forwards the entire parent process environment to the spawned subprocess. As a result, any MCP command executed in this manner inherits all environment variables from the host process, including sensitive data such as API keys, authentication tokens, and database credentials. This behavior introduces a security risk when untrusted or third-party commands are used. In common scenarios where MCP tools are invoked via package runners such as npx -y, arbitrary code from external or potentially compromised packages may execute with access to these inherited environment variables. This creates a risk of unintended credential exposure and enables potential supply chain attacks through silent exfiltration of secrets. This vulnerability is fixed in 4.5.128.

AnalysisAI

PraisonAI before version 4.5.128 exposes sensitive environment variables to untrusted subprocess commands executed through its MCP (Model Context Protocol) integration, enabling credential theft and supply chain attacks when third-party tools like npx packages are invoked. An unauthenticated local attacker with user interaction can trigger MCP commands that inherit the parent process environment, gaining access to API keys, authentication tokens, and database credentials without the knowledge of developers using PraisonAI. The vulnerability is fixed in version 4.5.128.

Technical ContextAI

PraisonAI's MCP integration spawns background server processes via Python's subprocess module using stdio-based command execution. The implementation passes user-supplied command strings directly to the subprocess module without sanitizing the environment dictionary. By default, Python's subprocess.Popen() forwards the entire parent process environment (os.environ) to child processes unless explicitly restricted via the env parameter. When MCP tools invoke external package runners such as npx -y, the spawned subprocess inherits sensitive environment variables from the host PraisonAI process, including API keys and credentials. This is a classic information disclosure vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) where the trust boundary between the parent process and dynamically-loaded third-party code is not properly enforced. The root cause is the absence of environment variable filtering or allowlisting before subprocess creation.

RemediationAI

Upgrade PraisonAI to version 4.5.128 or later, which fixes the environment variable exposure. No workaround is available without upgrading; however, organizations can mitigate risk by restricting sensitive environment variables in the runtime environment where PraisonAI executes (e.g., use dedicated service accounts with minimal credentials, avoid storing secrets in process-level environment variables, and instead use secret management systems or runtime injection mechanisms that do not forward credentials to subprocesses). Refer to the official GitHub security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pj2r-f9mw-vrcq for upgrade instructions and confirmation.