MervinPraison PraisonAI/praisonaiagents up to 4.5.138 tools.py import_tools_from_file code injection

Summaryinfo

A vulnerability was found in MervinPraison PraisonAI and praisonaiagents up to 4.5.138. It has been rated as critical. The affected element is the function import_tools_from_file of the file tools.py. Performing a manipulation results in code injection. This vulnerability is identified as CVE-2026-40287. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in MervinPraison PraisonAI and praisonaiagents up to 4.5.138. This affects the function import_tools_from_file of the file tools.py. The manipulation with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py (import_tools_from_file()), tool_resolver.py (_load_local_tools()), and CLI tool-loading paths blindly import ./tools.py at startup without any validation, sandboxing, or user confirmation. An attacker who can place a malicious tools.py in the directory where PraisonAI is launched (such as through a shared project, cloned repository, or writable workspace) achieves immediate arbitrary Python code execution in the host environment. This compromises the full PraisonAI process, the host system, and any connected data or credentials. This issue has been fixed in version 4.5.139.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-40287 since 04/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 4.5.139 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• MervinPraison

Name

• PraisonAI
• praisonaiagents

Version

• 4.5.138

Website

• Product: https://github.com/MervinPraison/PraisonAI/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion