CVE-2026-40288: PraisonAI YAML Workflow RCE Vulnerability

CVE-2026-40288 Overview

CVE-2026-40288 is a critical command injection vulnerability affecting PraisonAI, a multi-agent teams system. The vulnerability allows arbitrary command and code execution through untrusted YAML workflow files. When praisonai workflow run <file.yaml> loads a YAML file with type: job, the JobWorkflowExecutor in job_workflow.py processes steps that support run: (shell commands via subprocess.run()), script: (inline Python via exec()), and python: (arbitrary Python script execution)—all without any validation, sandboxing, or user confirmation.

Critical Impact

An attacker who can supply or influence a workflow YAML file can achieve full arbitrary command execution on the host system, compromising the machine and any accessible data or credentials. This is particularly dangerous in CI pipelines, shared repositories, or multi-tenant deployment environments.

Affected Products

• PraisonAI versions below 4.5.139
• praisonaiagents versions below 1.5.140

Discovery Timeline

• 2026-04-14 - CVE-2026-40288 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-40288

Vulnerability Analysis

This vulnerability represents a severe case of CWE-78 (OS Command Injection) where the PraisonAI workflow engine fails to implement any security controls around YAML-based workflow processing. The vulnerability is characterized by a network-accessible attack surface that requires no privileges or user interaction to exploit.

The core issue stems from the workflow engine's design philosophy of trust-by-default for YAML configuration files. When a workflow file is processed, the engine directly executes commands and scripts without validating their source, content, or intent. This architectural flaw transforms a configuration mechanism into an attack vector for remote code execution.

The impact is severe because PraisonAI is commonly deployed in environments where YAML files may come from various sources—CI/CD pipelines, shared development repositories, or automated systems. In multi-tenant environments, this vulnerability could allow one user to compromise resources belonging to others.

Root Cause

The root cause is the absence of input validation, sandboxing, or user confirmation when processing YAML workflow files. The affected code paths in workflow.py and job_workflow.py blindly trust the contents of workflow files and execute arbitrary shell commands and Python code. Specifically, the functions action_run() in workflow.py and _exec_shell(), _exec_inline_python(), and _exec_python_script() in job_workflow.py pass user-controlled input directly to system execution functions like subprocess.run() and Python's exec() without any sanitization.

Attack Vector

The attack vector is network-based, targeting environments where an attacker can supply or influence workflow YAML files. Common attack scenarios include:

1. CI/CD Pipeline Attacks: Malicious pull requests containing weaponized YAML workflow files
2. Shared Repository Exploitation: Injecting malicious workflow files into shared development repositories
3. Multi-tenant Environment Compromise: One tenant crafting malicious workflows that affect the underlying infrastructure or other tenants
4. Supply Chain Attacks: Distributing seemingly legitimate workflow templates that contain embedded malicious commands

A malicious YAML workflow file would contain type: job with steps using run:, script:, or python: directives containing attacker-controlled commands. When processed by PraisonAI, these commands execute with the privileges of the PraisonAI process, potentially leading to complete system compromise.

Detection Methods for CVE-2026-40288

Indicators of Compromise

• Unexpected processes spawned as children of PraisonAI workflow processes
• Unusual network connections originating from systems running PraisonAI workflows
• Modifications to system files or creation of new user accounts following workflow execution
• Suspicious YAML files in workflow directories containing shell commands or Python code in run:, script:, or python: fields

Detection Strategies

• Monitor for execution of subprocess.run() or exec() calls originating from PraisonAI processes
• Implement file integrity monitoring on directories where workflow YAML files are stored
• Deploy endpoint detection rules that alert on command execution patterns from Python-based AI agent frameworks
• Review workflow YAML files for suspicious run:, script:, or python: directives before execution

Monitoring Recommendations

• Enable detailed logging for all PraisonAI workflow executions including command arguments
• Implement audit trails for YAML file modifications in workflow directories
• Configure SentinelOne to monitor for behavioral patterns associated with command injection exploitation
• Set up alerts for any exec() or subprocess.run() calls made by PraisonAI processes

How to Mitigate CVE-2026-40288

Immediate Actions Required

• Upgrade PraisonAI to version 4.5.139 or later immediately
• Upgrade praisonaiagents to version 1.5.140 or later
• Audit all existing YAML workflow files for potentially malicious content
• Restrict filesystem permissions on workflow directories to prevent unauthorized modifications
• Implement strict access controls on who can submit workflow files for execution

Patch Information

The vulnerability has been addressed in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140. Organizations should upgrade to these versions immediately. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Implement a manual review process for all workflow YAML files before execution
• Deploy PraisonAI in isolated containers with minimal privileges and network access
• Use allowlisting to restrict which YAML files can be executed based on cryptographic signatures
• Disable workflow execution capabilities if not required for your deployment

# Example: Restricting workflow directory permissions
chmod 750 /path/to/praisonai/workflows
chown root:praisonai-admins /path/to/praisonai/workflows

# Example: Running PraisonAI in a restricted container
docker run --read-only --security-opt=no-new-privileges \
  --cap-drop=ALL --network=none \
  praisonai:4.5.139