CVE-2026-40287: PraisonAI has RCE via Automatic tools.py Import

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-14 · updated 2026-10-26
Weakness: CWE-94

Description

PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py (import_tools_from_file()), tool_resolver.py (_load_local_tools()), and CLI tool-loading paths blindly import ./tools.py at startup without any validation, sandboxing, or user confirmation. An attacker who can place a malicious tools.py in the directory where PraisonAI is launched (such as through a shared project, cloned repository, or writable workspace) achieves immediate arbitrary Python code execution in the host environment. This compromises the full PraisonAI process, the host system, and any connected data or credentials. This issue has been fixed in version 4.5.139.

Affected products

MervinPraison PraisonAI: before 4.5.139 — fixed in 4.5.139
MervinPraison praisonaiagents: before 1.5.140 — fixed in 1.5.140

How to fix

Upgrade to a fixed version: MervinPraison PraisonAI 4.5.139; MervinPraison praisonaiagents 1.5.140. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-40287 or the next vulnerability affects your stack