CVE-2026-40154 - Vulnerability Analysis

Overview

PraisonAI < 4.5.128 contains a template injection caused by treating remotely fetched template files as trusted executable code without integrity verification or origin validation, letting remote attackers execute malicious templates, exploit requires remote template fetching.

Severity & Score

Impact

Remote attackers can execute malicious templates, potentially leading to remote code execution and full system compromise.

Mitigation

Upgrade to version 4.5.128 or later.

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pv9q-275h-rh7x

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner