PraisonAI Flaw: Untrusted YAML Leads to RCE

A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-40288, has been identified in PraisonAI’s multi-agent teams system. According to the National Vulnerability Database, versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents are susceptible due to insufficient validation of untrusted YAML files within the workflow engine.

The core issue lies in how the praisonai workflow run <file.yaml> command processes YAML files with type: job. The JobWorkflowExecutor in job_workflow.py fails to properly sanitize or sandbox steps that leverage run: for shell commands, script: for inline Python, or python: for arbitrary Python script execution. This allows an attacker to inject and execute arbitrary commands or code on the host system without any user confirmation, leading to full system compromise.

This flaw, rated a staggering 9.8 CVSS (CRITICAL), is particularly dangerous in environments where attackers can influence or supply workflow YAML files, such as CI/CD pipelines, shared code repositories, or multi-tenant deployments. The National Vulnerability Database highlights CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-94 (Improper Control of Generation of Code (‘Code Injection’)) as the underlying weaknesses. Patches are available in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140.