CVE-2026-40088: PraisonAI OS Command Injection via Shell Metacharacters
CVE-2026-40088 is an OS command injection flaw (CWE-78) in PraisonAI, a multi-agent teams system, affecting versions before 4.5.121. According to the record, user-controlled input reaching the execute_command function and workflow shell execution can carry shell metacharacters, allowing arbitrary shell commands. The vendor-linked advisory indicates the issue is fixed in 4.5.121, and no confirmed exploitation appears in the sources consulted.
Overview
PraisonAI is described as a multi-agent teams system. The record states that the execute_command function and workflow shell execution accept user-controlled input from agent workflows, YAML definitions and LLM-generated tool calls. Shell metacharacters in that input can alter the command that is run, which is the weakness class CWE-78 (OS Command Injection).
Impact
The record describes the potential result as arbitrary shell command execution. NVD scores the issue 9.6 (critical) under CVSS 3.1, with a network attack vector, low complexity, no required privileges, required user interaction, changed scope and high confidentiality, integrity and availability impact. The GitHub CNA score in the record is 9.7. Whether a specific deployment is exposed depends on how it routes untrusted input into these paths, which the record does not detail.
Affected products and versions
- MervinPraison PraisonAI: versions before 4.5.121
- Praison Praisonai: versions before 4.5.121
The record lists 4.5.121 as the fixed version. The fixes field in the record is empty, but the references include a release page for the fixed version, so the fix is documented by the vendor reference rather than by a structured fix entry.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is reported there. No confirmed exploitation appears in the sources consulted. The SSVC data in the record rates exploitation as proof-of-concept and automatability as no, and the references include an entry tagged as Exploit. These signals indicate that public exploitation material may exist, but they do not confirm attacks in the wild.
Remediation and mitigation
- Upgrade PraisonAI to version 4.5.121 or later, as stated in the record.
- Review where agent workflows, YAML definitions and LLM-generated tool calls can reach shell execution and restrict untrusted input from those paths until the upgrade is complete.
- Run agent workloads with least privilege and isolate them so that a command injection cannot easily reach sensitive data or systems.
- Consult the vendor advisory for further guidance: GitHub Security Advisory.
Detection guidance
- Monitor logs of PraisonAI processes for unexpected child processes spawned by agent or workflow runtimes.
- Audit workflow and YAML definitions for unvalidated input passed into shell-related functions.
- Alert on unusual outbound connections or file changes originating from the agent host.
Limitations of the available information
The record does not describe the exact input fields, a vendor-provided proof of concept or specific indicators of compromise. The fixes list is empty in the structured data, and the EPSS probability in the record is low. Affected deployments beyond the two listed product entries are unknown.
Frequently asked questions
Which PraisonAI versions are affected by CVE-2026-40088?
The record lists both MervinPraison PraisonAI and Praison Praisonai as affected in versions before 4.5.121.
Is CVE-2026-40088 known to be actively exploited?
The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted. SSVC data indicates proof-of-concept activity may exist.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.