MervinPraison PraisonAI up to 4.5.127 Cloud Run Service deploy.py openai_model/openai_key/openai_base argument injection

Summaryinfo

A vulnerability was found in MervinPraison PraisonAI up to 4.5.127. It has been declared as critical. Impacted is an unknown function of the file deploy.py of the component Cloud Run Service. Such manipulation of the argument openai_model/openai_key/openai_base leads to argument injection. This vulnerability is listed as CVE-2026-40113. The attack must be carried out locally. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in MervinPraison PraisonAI up to 4.5.127. It has been rated as critical. Affected by this issue is some unknown processing of the file deploy.py of the component Cloud Run Service. The manipulation of the argument openai_model/openai_key/openai_base with an unknown input leads to a argument injection vulnerability. Using CWE to declare the problem leads to CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. Impacted is confidentiality, integrity, and availability. CVE summarizes:

PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for --set-env-vars. A comma in any of the three values causes gcloud to parse the trailing text as additional KEY=VALUE definitions, injecting arbitrary environment variables into the deployed Cloud Run service. This vulnerability is fixed in 4.5.128.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-40113 since 04/09/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.

Upgrading to version 4.5.128 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• MervinPraison

Name

• PraisonAI

Version

• 4.5.127

Website

• Product: https://github.com/MervinPraison/PraisonAI/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion