PT-2026-31781 · Flask+2 · Flask+2

Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-40112

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.5.128

Description PraisonAI is a multi-agent teams system. The Flask API endpoint in src/praisonai/api.py renders agent output as HTML without proper sanitization. The sanitize html function depends on the nh3 library, which is not a declared dependency. When nh3 is not installed, the sanitization process is bypassed, allowing an attacker to inject arbitrary JavaScript that executes in the browser of anyone viewing the API output. This can occur if an attacker can influence agent input through methods like RAG data poisoning, web scraping results, or prompt injection.

Recommendations Update PraisonAI to version 4.5.128 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40112

GHSA-CFG2-MXFJ-J6PW

Affected Products

Flask

Praisonai

Nh3

References · 7

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cfg2-mxfj-j6pw · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40112 · Security Note
• https://osv.dev/vulnerability/GHSA-cfg2-mxfj-j6pw · Vendor Advisory
• https://github.com/MervinPraison/PraisonAI · Note
• https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.128 · Note
• https://twitter.com/VulmonFeeds/status/2042433775380910515 · Twitter Post
• https://twitter.com/CVEnew/status/2042561844553093232 · Twitter Post