PraisonAI Vulnerable to OS Command Injection

The impact of CVE-2026-40088 is severe, enabling an attacker to gain complete control over the system running PraisonAI. Successful exploitation allows for arbitrary code execution with the privileges of the PraisonAI process. This could lead to data exfiltration, system compromise, and potentially lateral movement within the network. The vulnerability's exposure through multiple input vectors (YAML, agent configs, LLM calls) increases the attack surface and potential for exploitation. The use of shell=True directly exposes the system to command injection, similar to vulnerabilities seen in other applications that mishandle user input in shell commands.

Organizations heavily reliant on PraisonAI for automation and AI workflows are particularly at risk. Environments where agent configurations are managed through YAML files and LLMs are used to generate tool calls are especially vulnerable. Shared hosting environments where multiple users share the same PraisonAI instance are also at increased risk.

• python: Monitor PraisonAI logs for suspicious shell commands or process executions. Look for instances of subprocess.run() being called with shell=True and user-controlled input.

import re
# Example: Check PraisonAI logs for suspicious commands
with open('praisonai.log', 'r') as f:
    for line in f:
        if re.search(r'subprocess.run\(shell=True', line) and re.search(r'user_input', line):
            print(f'Potential command injection: {line}')

• linux / server: Use journalctl to filter for PraisonAI process executions and examine the command-line arguments for suspicious shell metacharacters.

journalctl -u praisonai --grep='subprocess.run(shell=True'

• generic web: Examine access and error logs for requests containing suspicious shell metacharacters in parameters or headers.

1. 2026-04-08Disclosure

   disclosure

1. Réservé2026-04-09
2. Publiée2026-04-08
3. Modifiée2026-04-10
4. EPSS mis à jour2026-04-17

The primary mitigation for CVE-2026-40088 is to upgrade PraisonAI to version 4.5.121 or later. If upgrading immediately is not possible, consider implementing temporary workarounds. Strict input validation and sanitization of all user-controlled data within workflow definitions, agent configurations, and LLM-generated tool calls is crucial. Disable or restrict the use of LLM-generated tool calls if possible. Consider using a Web Application Firewall (WAF) with command injection rules to filter malicious input. Monitor system logs for suspicious shell activity and unusual process executions.