CVE-2026-40288: PraisonAI YAML Workflow RCE Vulnerability

CVE-2026-40288 Overview

CVE-2026-40288 is a critical command injection vulnerability affecting PraisonAI, a multi-agent teams system. The vulnerability allows arbitrary command and code execution through untrusted YAML workflow files. When praisonai workflow run <file.yaml> loads a YAML file with type: job, the JobWorkflowExecutor in job_workflow.py processes steps that support run: (shell commands via subprocess.run()), script: (inline Python via exec()), and python: (arbitrary Python script execution)—all without any validation, sandboxing, or user confirmation.

Critical Impact
An attacker who can supply or influence a workflow YAML file can achieve full arbitrary command execution on the host system, compromising the machine and any accessible data or credentials. This is particularly dangerous in CI pipelines, shared repositories, or multi-tenant deployment environments.

Affected Products

PraisonAI versions below 4.5.139
praisonaiagents versions below 1.5.140

Discovery Timeline

2026-04-14 - CVE-2026-40288 published to NVD
2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-40288

Vulnerability Analysis

This vulnerability represents a severe case of CWE-78 (OS Command Injection) where the PraisonAI workflow engine fails to implement any security controls around YAML-based workflow processing. The vulnerability is characterized by a network-accessible attack surface that requires no privileges or user interaction to exploit.

The core issue stems from the workflow engine's design philosophy of trust-by-default for YAML configuration files. When a workflow file is processed, the engine directly executes commands and scripts without validating their source, content, or intent. This architectural flaw transforms a configuration mechanism into an attack vector for remote code execution.

The impact is severe because PraisonAI is commonly deployed in environments where YAML files may come from various sources—CI/CD pipelines, shared development repositories, or automated systems. In multi-tenant environments, this vulnerability could allow one user to compromise resources belonging to others.

Root Cause

The root cause is the absence of input validation, sandboxing, or user confirmation when processing YAML workflow files. The affected code paths in workflow.py and job_workflow.py blindly trust the contents of workflow files and execute arbitrary shell commands and Python code. Specifically, the functions action_run() in workflow.py and _exec_shell(), _exec_inline_python(), and _exec_python_script() in job_workflow.py pass user-controlled input directly to system execution functions like subprocess.run() and Python's exec() without any sanitization.

Attack Vector

The attack vector is network-based, targeting environments where an attacker can supply or influence workflow YAML files. Common attack scenarios include:

CI/CD Pipeline Attacks: Malicious pull requests containing weaponized YAML workflow files
Shared Repository Exploitation: Injecting malicious workflow files into shared development repositories
Multi-tenant Environment Compromise: One tenant crafting malicious workflows that affect the underlying infrastructure or other tenants
Supply Chain Attacks: Distributing seemingly legitimate workflow templates that contain embedded malicious commands

A malicious YAML workflow file would contain type: job with steps using run:, script:, or python: directives containing attacker-controlled commands. When processed by PraisonAI, these commands execute with the privileges of the PraisonAI process, potentially leading to complete system compromise.

Detection Methods for CVE-2026-40288

Indicators of Compromise

Unexpected processes spawned as children of PraisonAI workflow processes
Unusual network connections originating from systems running PraisonAI workflows
Modifications to system files or creation of new user accounts following workflow execution
Suspicious YAML files in workflow directories containing shell commands or Python code in run:, script:, or python: fields

Detection Strategies

Monitor for execution of subprocess.run() or exec() calls originating from PraisonAI processes
Implement file integrity monitoring on directories where workflow YAML files are stored
Deploy endpoint detection rules that alert on command execution patterns from Python-based AI agent frameworks
Review workflow YAML files for suspicious run:, script:, or python: directives before execution

Monitoring Recommendations

Enable detailed logging for all PraisonAI workflow executions including command arguments
Implement audit trails for YAML file modifications in workflow directories
Configure SentinelOne to monitor for behavioral patterns associated with command injection exploitation
Set up alerts for any exec() or subprocess.run() calls made by PraisonAI processes

How to Mitigate CVE-2026-40288

Immediate Actions Required

Upgrade PraisonAI to version 4.5.139 or later immediately
Upgrade praisonaiagents to version 1.5.140 or later
Audit all existing YAML workflow files for potentially malicious content
Restrict filesystem permissions on workflow directories to prevent unauthorized modifications
Implement strict access controls on who can submit workflow files for execution

Patch Information

The vulnerability has been addressed in PraisonAI version 4.5.139 and praisonaiagents version 1.5.140. Organizations should upgrade to these versions immediately. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

Implement a manual review process for all workflow YAML files before execution
Deploy PraisonAI in isolated containers with minimal privileges and network access
Use allowlisting to restrict which YAML files can be executed based on cryptographic signatures
Disable workflow execution capabilities if not required for your deployment

bash

# Example: Restricting workflow directory permissions
chmod 750 /path/to/praisonai/workflows
chown root:praisonai-admins /path/to/praisonai/workflows

# Example: Running PraisonAI in a restricted container
docker run --read-only --security-opt=no-new-privileges \
  --cap-drop=ALL --network=none \
  praisonai:4.5.139