CVE-2026-40287

{"id": "CVE-2026-40287", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40287", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-14T13:23:23.221160Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MervinPraison", "product": "PraisonAI", "versions": [{"status": "affected", "version": "< 4.5.139"}]}, {"vendor": "MervinPraison", "product": "praisonaiagents", "versions": [{"status": "affected", "version": "< 1.5.140"}]}]}], "published": "2026-04-14T04:17:11.977", "references": [{"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g985-wjh9-qxxc", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g985-wjh9-qxxc", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py (import_tools_from_file()), tool_resolver.py (_load_local_tools()), and CLI tool-loading paths blindly import ./tools.py at startup without any validation, sandboxing, or user confirmation. An attacker who can place a malicious tools.py in the directory where PraisonAI is launched (such as through a shared project, cloned repository, or writable workspace) achieves immediate arbitrary Python code execution in the host environment. This compromises the full PraisonAI process, the host system, and any connected data or credentials. This issue has been fixed in version 4.5.139."}, {"lang": "es", "value": "PraisonAI es un sistema de equipos multiagente. Las versiones 4.5.138 e inferiores son vulnerables a la ejecuci\u00f3n de c\u00f3digo arbitrario mediante la importaci\u00f3n autom\u00e1tica y no saneada de un archivo tools.py desde el directorio de trabajo actual. Componentes que incluyen call.py (import_tools_from_file()), tool_resolver.py (_load_local_tools()) y las rutas de carga de herramientas de la CLI importan ciegamente ./tools.py al inicio sin ninguna validaci\u00f3n, sandboxing o confirmaci\u00f3n del usuario. Un atacante que puede colocar un archivo tools.py malicioso en el directorio donde se inicia PraisonAI (como a trav\u00e9s de un proyecto compartido, un repositorio clonado o un espacio de trabajo escribible) logra la ejecuci\u00f3n inmediata de c\u00f3digo Python arbitrario en el entorno del host. Esto compromete el proceso completo de PraisonAI, el sistema host y cualquier dato o credencial conectado. Este problema ha sido solucionado en la versi\u00f3n 4.5.139."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5F6A0D4-AFE6-4DDA-A1C0-E74C7DD46E00", "versionEndExcluding": "4.5.139"}, {"criteria": "cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "37CF4D9C-AD55-414A-9BF2-49A51F03A682", "versionEndExcluding": "1.5.140"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}