CVE-2026-40113 - Vulnerability Analysis

Overview

PraisonAI < 4.5.128 contains an environment variable injection vulnerability caused by improper validation of comma characters in openai_model, openai_key, and openai_base during gcloud run deploy, letting attackers inject arbitrary environment variables, exploit requires crafted environment variable values.

Severity & Score

Impact

Attackers can inject arbitrary environment variables into deployed Cloud Run services, potentially leading to unauthorized access or code execution.

Mitigation

Update to version 4.5.128 or later.

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fvxx-ggmx-3cjg

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner