CVE-2026-40288: RCE in praisonaiagents Workflow Execution

The vulnerability lies within the praisonai workflow run <file.yaml> command, which loads and processes YAML files to define and execute workflows. Specifically, the JobWorkflowExecutor in job_workflow.py is susceptible to exploitation. The type: job configuration allows for three distinct attack vectors: run: executes shell commands via subprocess.run(), script: executes inline Python code via exec(), and python: executes arbitrary Python scripts. A carefully crafted YAML file can leverage any of these options to achieve remote code execution, effectively granting an attacker complete control over the affected system. This represents a significant security risk, potentially leading to data breaches, system compromise, and further lateral movement within the network.

1. Reserved2026-04-10
2. Published2026-04-10
3. Modified2026-04-14
4. EPSS updated2026-04-21

The primary mitigation for CVE-2026-40288 is to upgrade praisonaiagents to version 1.5.140 or later, which contains the necessary fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict access to the praisonai workflow run command to trusted users only. Implement input validation to sanitize YAML files before processing, although this is complex and may not be fully effective. Consider using a Web Application Firewall (WAF) or proxy to filter potentially malicious YAML payloads. Monitor system logs for suspicious activity related to workflow execution, particularly commands executed by subprocess.run() or exec(). After upgrading, confirm the fix by attempting to execute a known malicious YAML file (in a controlled environment) and verifying that it is blocked.