Praisonai CVE-2026-40288

No special conditions — remote unauthenticated exploitation against default configurations of PraisonAI versions below 4.5.139 and praisonaiagents below 1.5.140 when running untrusted YAML workflow files via 'praisonai workflow run' command.

This vulnerability presents critical real-world risk across multiple deployment scenarios. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity, requiring no authentication or user interaction-the most severe combination possible. The scope remains unchanged (S:U), but all CIA triad elements are rated high impact (C:H/I:H/A:H), justifying the 9.8 critical score. Real-world risk is amplified in CI/CD pipelines where workflow files may be automatically pulled from repositories, in collaborative environments with shared workflow templates, and in multi-tenant deployments where users can supply workflow definitions. The attack requires only the ability to influence a YAML file processed by the 'praisonai workflow run' command, making it highly automatable. While no EPSS score or CISA KEV status is available, the technical barrier to exploitation is minimal-an attacker simply crafts a YAML file with malicious 'run:' or 'script:' directives. The GitHub security advisory confirms vendor acknowledgment. This is a genuine critical-priority issue, not inflated by CVSS scoring, as it enables immediate system compromise with no defensive barriers. Organizations using PraisonAI in automated or multi-user contexts face immediate remote code execution exposure.

An attacker targeting a development team using PraisonAI in their CI/CD pipeline submits a pull request to a shared repository containing a seemingly legitimate workflow YAML file with malicious 'run:' directives. When the automated pipeline executes 'praisonai workflow run malicious.yaml', the embedded commands execute with the privileges of the CI runner, allowing the attacker to exfiltrate secrets, inject backdoors into build artifacts, or pivot to connected infrastructure. In multi-tenant platforms, a malicious user uploads a workflow file containing 'script:' blocks with Python code that establishes reverse shells or harvests credentials from the host environment.