CVE-2026-40288

When the command `praisonai workflow run <file.yaml>` loads a YAML file containing a `type: job` entry, the JobWorkflowExecutor component processes steps handling three execution vectors: `run:` (shell commands via subprocess.run()), `script:` (inline Python via exec()), and `python:` (execution of arbitrary Python scripts). All these code paths — action_run() in workflow.py and _exec_shell(), _exec_inline_python(), and _exec_python_script() in job_workflow.py — operate without any security controls. An attacker who is able to provide or influence the content of a YAML file (e.g., in code repositories, CI/CD pipelines, or multi-tenant environments) can thus trigger the execution of arbitrary commands on the host.

An attacker can achieve full execution of arbitrary commands and code on the host system (RCE), leading to machine compromise, data theft, and theft of stored credentials.

PraisonAI should be updated to version 4.5.139 or newer and praisonaiagents to version 1.5.140 or newer. As a supplementary measure, the ability to provide or modify YAML workflow files should be restricted to trusted users, particularly in CI/CD environments, shared repositories, and multi-tenant deployments.

PraisonAI in versions below 4.5.139 and praisonaiagents in versions below 1.5.140