PT-2026-31810 · Praisonai · Praisonai

Published 2026-04-09 · Updated 2026-04-12 · CVE-2026-40154

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.5.128

Description PraisonAI is a multi-agent teams system. Prior to version 4.5.128, the software treats remotely fetched template files as trusted executable code without performing integrity verification, origin validation, or user confirmation. This can enable supply chain attacks through malicious templates. Attackers can potentially hijack AI workflows by serving malicious templates from compromised sources.

Recommendations Update to version 4.5.128 or later.

Fix

RCE

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-40154

GHSA-PV9Q-275H-RH7X

Affected Products

Praisonai

References · 11

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pv9q-275h-rh7x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40154 · Security Note
• https://osv.dev/vulnerability/GHSA-pv9q-275h-rh7x · Vendor Advisory
• https://github.com/MervinPraison/PraisonAI · Note
• https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.128 · Note
• https://twitter.com/CVEnew/status/2042364284143825042 · Twitter Post
• https://twitter.com/pulsepatchio/status/2043164177531859198 · Twitter Post
• https://twitter.com/0dayPublishing/status/2042360556833612128 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042400491913494563 · Twitter Post
• https://twitter.com/CCBalert/status/2042602594778951691 · Twitter Post
• https://twitter.com/CveFindCom/status/2042373076919124049 · Twitter Post