CVE-2026-40154

PoC —

CVSS 3.1

9.6 critical

EPSS

<1%p23

Published

Apr 9, 2026 (Apr 9, 2026)

Modified

Jun 17, 2026

Description

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates. This vulnerability is fixed in 4.5.128.

Vendors: praison
Products: praisonai
Weakness: CWE-829
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.