What is the CVSS score of CVE-2026-40288?

CVE-2026-40288 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2026-40288?

PraisonAI workflow engine versions below 4.5.139 and praisonaiagents below 1.5.140 contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-40288?

Within 24 hours: Identify all systems running PraisonAI workflow engine <4.5.139 or praisonaiagents <1.5.140 (audit container registries, dependency manifests, and deployment configs). Within 7 days: Implement network segmentation to restrict workflow engine access to trusted sources only; disable or isolate affected instances pending remediation. Within 30 days: Upgrade PraisonAI workflow engine to version 4.5.139 or later and praisonaiagents to version 1.5.140 or later; validate YAML workflows for malicious directives before execution.

Python CVE-2026-40288

EUVD-2026-22209 CRITICAL

OS Command Injection (CWE-78)

2026-04-14 GitHub_M

GHSA-vc46-vw85-3wvm

RCE Command Injection Python

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Patch released

Apr 15, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 14, 2026 - 04:10 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 04:00 euvd

EUVD-2026-22209

Analysis Generated

Apr 14, 2026 - 04:00 vuln.today

CVE Published

Apr 14, 2026 - 03:00 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary command and code execution through untrusted YAML files. When praisonai workflow run <file.yaml> loads a YAML file with type: job, the JobWorkflowExecutor in job_workflow.py processes steps that support run: (shell commands via subprocess.run()), script: (inline Python via exec()), and python: (arbitrary Python script execution)-all without any validation, sandboxing, or user confirmation. The affected code paths include action_run() in workflow.py and _exec_shell(), _exec_inline_python(), and _exec_python_script() in job_workflow.py. An attacker who can supply or influence a workflow YAML file (particularly in CI pipelines, shared repositories, or multi-tenant deployment environments) can achieve full arbitrary command execution on the host system, compromising the machine and any accessible data or credentials. This issue has been fixed in versions 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents.

AnalysisAI

Arbitrary command and code execution in PraisonAI's workflow engine (versions <4.5.139) and praisonaiagents (<1.5.140) allows remote unauthenticated attackers to execute shell commands and Python code through malicious YAML workflow files. The vulnerability stems from unsafe processing of 'run:', 'script:', and 'python:' directives in job-type workflows without validation or sandboxing. With a critical CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interac

Technical ContextAI

PraisonAI is a multi-agent teams system with workflow orchestration capabilities. The vulnerability resides in the JobWorkflowExecutor component (job_workflow.py) and workflow.py's action_run() function, which process YAML-defined workflows. When a YAML file specifies 'type: job', the engine parses step definitions containing 'run:' (executed via subprocess.run()), 'script:' (evaluated through Python's exec()), and 'python:' (arbitrary script execution) directives. The root cause is CWE-78 (OS Command Injection), but extends to arbitrary code execution through multiple vectors. None of the three execution methods implement input validation, path restrictions, or sandboxing mechanisms. The affected products are mervinpraison:praisonai (Python package) and mervinpraison:praisonaiagents, both part of an AI agent framework ecosystem. The workflow execution model treats YAML files as trusted input, creating a fundamental trust boundary violation when processing externally-sourced or user-controlled workflow definitions.

RemediationAI

Immediately upgrade to PraisonAI version 4.5.139 or later and praisonaiagents version 1.5.140 or later, which contain fixes for the arbitrary command execution vulnerability. Update via Python package manager using 'pip install --upgrade praisonai praisonaiagents' and verify installed versions with 'pip show praisonai praisonaiagents'. Until patching is complete, implement strict controls on workflow YAML file sources: prohibit processing of user-supplied or externally-sourced workflow files, implement mandatory code review for all workflow definitions before execution, and restrict workflow execution permissions to trusted administrators only. In CI/CD environments, validate and sanitize workflow files before processing, use isolated execution environments with restricted permissions, and consider disabling the job workflow feature entirely if not operationally required. Review audit logs for suspicious 'praisonai workflow run' invocations with external YAML files. The vendor security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vc46-vw85-3wvm provides additional technical details and confirms patch availability. No workarounds fully mitigate the risk; upgrading is the only complete remediation.