CVE-2026-40111

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed and shell metacharacters are interpreted by /bin/sh before the intended command executes. Two independent attack surfaces exist. The first is via pre_run_command and post_run_command hook event types registered through the hooks configuration. The second and more severe surface is the .praisonai/hooks.json lifecycle configuration, where hooks registered for events such as BEFORE_TOOL and AFTER_TOOL fire automatically during agent operation. An agent that gains file-write access through prompt injection can overwrite .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without further user interaction. This vulnerability is fixed in 1.5.128.

• CWE-78

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v7px-3835-7gjxExploit, Vendor Advisory
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v7px-3835-7gjxExploit, Vendor Advisory

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40106Wazuh is a free and open source platform used for threat pre…7.8
• CVE-2026-40107SiYuan is a personal knowledge management system. Prior to 3…6.5
• CVE-2026-40108GLPI is a free asset and IT management software package. In …7.1
• CVE-2026-40109Flux notification-controller is the event forwarder and noti…3.1
• CVE-2026-4011The Power Charts Lite plugin for WordPress is vulnerable to …6.4
• CVE-2026-40110Jupyter Server is the backend for Jupyter web applications. …7.3
• CVE-2026-40112PraisonAI is a multi-agent teams system. Prior to 4.5.128, t…6.1
• CVE-2026-40113PraisonAI is a multi-agent teams system. Prior to 4.5.128, d…8.1
• CVE-2026-40114PraisonAI is a multi-agent teams system. Prior to 4.5.128, t…10
• CVE-2026-40115PraisonAI is a multi-agent teams system. Prior to 4.5.128, t…7.5
• CVE-2026-40116PraisonAI is a multi-agent teams system. Prior to 4.5.128, t…7.5
• CVE-2026-40117PraisonAIAgents is a multi-agent teams system. Prior to 1.5.…7.5