PT-2026-31780 · Unknown · Praisonaiagents

Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-40111

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions PraisonAIAgents versions prior to 1.5.128

Description PraisonAIAgents is a multi-agent teams system. The memory hooks executor in PraisonAIAgents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed, allowing shell metacharacters to be interpreted by /bin/sh before the intended command executes. Two attack surfaces exist: through pre run command and post run command hook event types registered through the hooks configuration, and through the .praisonai/hooks.json lifecycle configuration. An agent gaining file-write access through prompt injection can overwrite .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without further user interaction.

Recommendations Update to PraisonAIAgents version 1.5.128 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-40111

GHSA-V7PX-3835-7GJX

Affected Products

Praisonaiagents

References · 7

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v7px-3835-7gjx · Exploit
• https://osv.dev/vulnerability/GHSA-v7px-3835-7gjx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40111 · Security Note
• https://github.com/MervinPraison/PraisonAI · Note
• https://twitter.com/0dayPublishing/status/2042356807494996013 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042444013525991860 · Twitter Post
• https://twitter.com/CVEnew/status/2042561848319578362 · Twitter Post