CVE-2026-40154 is a critical supply chain flaw in PraisonAI, scored CVSS 9.3. It treats template files fetched from remote sources as trusted code and runs them without integrity checks or user confirmation. Upgrade to 4.5.128 or later and review any templates you installed.
What's affected
- Affected: PraisonAI 4.5.117 and earlier per the advisory (the NVD record says prior to 4.5.128)
- Fixed: 4.5.128 or later
The advisory describes a template installed from a remote source such as GitHub. Its Python files, including tools.py, are written to a local cache and later loaded and executed when the template is used. It lists no code signing, no checksum validation, no pattern scanning and no confirmation step.
How to check if you're exposed
Check the version:
pip show praisonai
Then review the templates you have installed. Look in the template cache directory on the machines that run PraisonAI and read any tools.py file there. Remove templates you do not recognise, and note where each one came from.
What to do now
- Upgrade to 4.5.128 or later, or 4.5.133 to also pick up the related fixes.
- List the templates you installed, with their sources.
- Read the Python in each template before using it and delete the ones you cannot vouch for.
- Pin templates to a reviewed commit and not a moving branch.
- Run PraisonAI in an environment without access to production secrets.
Why it matters
The weakness is CWE-829, inclusion of functionality from an untrusted control sphere. The advisory frames it as a broken trust boundary: template metadata is data, but the Python files in the same download are code, and the tool executes them as soon as the template is used.
This pattern appears in package managers, plugin systems and agent frameworks alike. The fix class is the same everywhere: verify what you fetch, show the user what will run, and keep fetched code away from sensitive credentials. The CVSS vector requires user interaction, and the record does not mark exploitation in the wild.
Quick check
Does this affect me if I only use built in agents?
The advisory describes templates fetched from remote sources. If you never install one, the path is not used, but upgrading removes the question.
Sources
Last reviewed: 19 October 2026.
