What is the CVSS score of CVE-2026-40287?

CVE-2026-40287 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-40287?

PraisonAI versions 4.5.138 and earlier allow arbitrary Python code execution when the application automatically imports malicious tools.py files from the current working directory without validation,…. A patch is available.

How to fix or mitigate CVE-2026-40287?

Within 24 hours: Identify all systems running PraisonAI ≤4.5.138 and isolate high-risk instances (those processing sensitive data or operating in shared environments). Within 7 days: Implement network-level controls restricting PraisonAI process execution and enforce code review policies for all tools.py files before repository cloning or workspace setup. Within 30 days: Monitor vendor advisories for patched versions and establish a mandatory upgrade schedule; pending patch availability, evaluate alternative AI orchestration tools or implement sandboxing/containerization to limit process privileges.

Python CVE-2026-40287

EUVD-2026-22207 HIGH

Code Injection (CWE-94)

2026-04-14 GitHub_M

GHSA-g985-wjh9-qxxc

Code Injection RCE Python

8.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Patch released

Apr 15, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 14, 2026 - 04:10 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 04:00 euvd

EUVD-2026-22207

Analysis Generated

Apr 14, 2026 - 04:00 vuln.today

CVE Published

Apr 14, 2026 - 02:55 nvd

HIGH 8.4

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py (import_tools_from_file()), tool_resolver.py (_load_local_tools()), and CLI tool-loading paths blindly import ./tools.py at startup without any validation, sandboxing, or user confirmation. An attacker who can place a malicious tools.py in the directory where PraisonAI is launched (such as through a shared project, cloned repository, or writable workspace) achieves immediate arbitrary Python code execution in the host environment. This compromises the full PraisonAI process, the host system, and any connected data or credentials. This issue has been fixed in version 4.5.139.

AnalysisAI

Arbitrary Python code execution in PraisonAI ≤4.5.138 occurs when malicious tools.py files are automatically imported from the current working directory without validation. Attackers placing a crafted tools.py in shared projects, cloned repositories, or writable workspaces achieve immediate code execution with full process privileges upon PraisonAI startup. EPSS data not available, but the local attack vector (AV:L) requiring no privileges (PR:N) or user interaction (UI:N) enables exploitation through supply chain and workspace poisoning attacks. No public exploit identified at time of analysis, though the vulnerability is trivial to exploit given the straightforward code injection mechanism.

Technical ContextAI

PraisonAI is a multi-agent AI teams framework built on Python. The vulnerability stems from CWE-94 (Improper Control of Generation of Code/Code Injection) in three critical components: call.py's import_tools_from_file() function, tool_resolver.py's _load_local_tools() method, and CLI tool-loading initialization paths. These components use Python's dynamic import mechanisms to unconditionally load ./tools.py from the current working directory at application startup. The affected products include both cpe:2.3:a:mervinpraison:praisonai and cpe:2.3:a:mervinpraison:praisonaiagents packages. Python's import system executes module-level code during import operations, meaning any arbitrary Python code placed in tools.py executes immediately within the PraisonAI process context with full interpreter privileges. The lack of path validation, signature verification, sandboxing (via RestrictedPython or similar), or user confirmation transforms a legitimate extensibility feature into an automatic code execution mechanism. This represents a classic confused deputy problem where the application's trust in local filesystem contents is exploited.

RemediationAI

Upgrade immediately to PraisonAI version 4.5.139 or later, which implements validation and sanitization for tools.py imports according to the vendor security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g985-wjh9-qxxc. For environments unable to patch immediately, implement compensating controls: restrict write permissions on directories where PraisonAI is executed to trusted users only, use read-only mounts for project directories in containerized deployments, implement mandatory code review for all tools.py files before PraisonAI execution, and consider running PraisonAI within isolated virtual environments or containers with minimal filesystem access. Organizations using PraisonAI in CI/CD pipelines should audit all repository contents before automated execution and implement allowlisting for acceptable tools.py sources. Remove or quarantine any untrusted tools.py files from working directories prior to launching PraisonAI.