CVE-2026-40156— PraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI是Mervin Praison个人开发者的一个低代码多智能体协作框架。 PraisonAI 4.5.128之前版本存在安全漏洞，该漏洞源于自动加载并执行工作目录中的tools.py文件，可能导致任意代码执行。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-40156
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file named tools.py from the current working directory to discover and register custom agent tools. This loading process uses importlib.util.spec_from_file_location and immediately executes module-level code via spec.loader.exec_module() without explicit user consent, validation, or sandboxing. The tools.py file is loaded implicitly, even when it is not referenced in configuration files or explicitly requested by the user. As a result, merely placing a file named tools.py in the working directory is sufficient to trigger code execution. This behavior violates the expected security boundary between user-controlled project files (e.g., YAML configurations) and executable code, as untrusted content in the working directory is treated as trusted and executed automatically. If an attacker can place a malicious tools.py file into a directory where a user or automated system (e.g., CI/CD pipeline) runs praisonai, arbitrary code execution occurs immediately upon startup, before any agent logic begins. This vulnerability is fixed in 4.5.128.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
PraisonAI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PraisonAI是Mervin Praison个人开发者的一个低代码多智能体协作框架。 PraisonAI 4.5.128之前版本存在安全漏洞，该漏洞源于自动加载并执行工作目录中的tools.py文件，可能导致任意代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | < 4.5.128 | - |
|
II. Public POCs for CVE-2026-40156
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40156
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-40156 (1)
Same Patch Batch · MervinPraison · 2026-04-10 · 5 CVEs total
| CVE-2026-40158 | 8.6 HIGH | PraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mec |
| CVE-2026-40159 | 5.5 MEDIUM | PraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess Execution |
| CVE-2026-40157 | PraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack` | |
| CVE-2026-40160 | PraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallback |
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-57118
PraisonAI AgentTeam.launch exposes unauthenticated remote ag -
CVE-2026-62176
PraisonAI: Code Injection via f-string Interpolation in Depl -
CVE-2026-57147
praisonai-platform: default JWT signing secret 'dev-secret-c -
CVE-2026-57148
praisonai-platform 0.1.4 still boots on the hardcoded JWT se -
CVE-2026-57140
PraisonAI AgentOS exposes unauthenticated agent listing and
Same vendor: MervinPraison
-
CVE-2026-57118
PraisonAI AgentTeam.launch exposes unauthenticated remote ag -
CVE-2026-57143
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / s -
CVE-2026-62176
PraisonAI: Code Injection via f-string Interpolation in Depl -
CVE-2026-62179
PraisonAI: Platform members can delete owner issue dependenc -
CVE-2026-57147
praisonai-platform: default JWT signing secret 'dev-secret-c
Same weakness: CWE-94
-
CVE-2026-108962
storyicon comfyui_segment_anything GroundingDINO Model Loadi -
CVE-2026-108961
PaddlePaddle PaddleX Preprocessor processors.py NormalizeIma -
CVE-2026-108957
TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_ti -
CVE-2026-108945
iMoonLab yolov13 AutoBackend Model Loading autobackend.py ev -
CVE-2026-108944
repository RAE Config-Driven Model Instantiation model_utils
V. Comments for CVE-2026-40156
No comments yet