CVE-2026-40153 json
PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool
published 2026-04-09 7 mo ago modified 2026-10-26 13 d ago also EUVD-2026-21176 , GHSA-v8g7-9q6v-p3x8 , PYSEC-2026-2953
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False (line 88) for security. This allows exfiltration of secrets stored in environment variables (database credentials, API keys, cloud access keys). The approval system displays the unexpanded $VAR references to human reviewers, creating a deceptive approval where the displayed command differs from what actually executes. This vulnerability is fixed in 1.5.128.
Patch / fix
- pypi praisonaiagents 1.5.128
- praison praisonaiagents 1.5.128
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v8g7-9q6v-p3x8 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | praisonaiagents | <1.5.128 |
1.5.128 |
Affected products
- MervinPraison PraisonAIAgents
Classification
- Weakness
-
- CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable
References
-
github.com
/MervinPraison/PraisonAI/security/advisories/GHSA-v8g7-9q6v-p3x8
exploit, web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-40153
advisory
-
github.com
/MervinPraison/PraisonAI
package
-
pypi.org
/project/praisonaiagents
package
-
github.com
/advisories/GHSA-v8g7-9q6v-p3x8
advisory
Sources
- CVE List CVE-2026-40153
- GitHub Advisory GHSA-v8g7-9q6v-p3x8
- NVD CVE-2026-40153
- OSV PYSEC-2026-2953
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.