CVE-2026-40154: PraisonAI Vulnerable Untrusted Remote Template Code Execution

April 10, 2026

PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates.

References

github.com/MervinPraison/PraisonAI
github.com/MervinPraison/PraisonAI/releases/tag/v4.5.128
github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pv9q-275h-rh7x
github.com/advisories/GHSA-pv9q-275h-rh7x
nvd.nist.gov/vuln/detail/CVE-2026-40154

Code Behaviors & Features

Detect and mitigate CVE-2026-40154 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →