CVE-2026-40088 is a critical command injection flaw in PraisonAI, scored CVSS 9.6. Before version 4.5.121, the execute_command function and workflow shell steps pass input to a shell, and that input can come from YAML files and model generated tool calls. Upgrade to 4.5.121 or later.
What's affected
- Affected: PraisonAI before 4.5.121
- Fixed: 4.5.121
The GitHub advisory describes several input paths: YAML workflow step definitions, agent configuration files, LLM generated tool call parameters, and recipe step configurations. Its default for shell execution was on.
If you pin PraisonAI for other reasons, note that later advisories in this series (CVE-2026-40114 and CVE-2026-40154 need 4.5.128, CVE-2026-40315 needs 4.5.133) mean a single upgrade to 4.5.133 or later covers all four.
How to check if you're exposed
Check the installed version:
pip show praisonai
pip list | grep -i praisonai
Check your lock files and container images too. Then search your agent and workflow YAML for shell type steps and for tools that run commands:
grep -rn "shell" --include=*.yaml --include=*.yml .
Any workflow that lets text from a model or a third party become a command line is a place to tighten.
What to do now
- Upgrade PraisonAI to 4.5.133 or later, which is above every fix version named across the related advisories.
- Review workflows and agents that run shell commands and remove the ones you do not need.
- Run agents under a low privilege account or in a container with limited filesystem and network access.
- Do not run workflow files from sources you have not read.
- Rebuild container images so the old version does not stay in a cached layer.
Why it matters
The weakness is CWE-78, OS command injection. The advisory's root cause is that commands are passed to a subprocess with shell interpretation turned on, so characters such as semicolons and pipes are treated as shell syntax. Its remediation advice is to disable shell by default, validate input, and pass commands as argument lists.
Agent frameworks make this class more serious because the text feeding a command can come from a model. A prompt injection in a document the agent reads could become a command. That is a reason to treat model output as untrusted input and to limit what the agent process can touch. The record does not report exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to upgrade even if I only run trusted workflows?
Yes, upgrade. Model generated tool calls are one of the input paths in the advisory, and you do not control what a model returns.
Sources
Last reviewed: 19 October 2026.
