External risk intelligence

PraisonAI Remotely Fetched Templates Not Verified Enabling Supply Chain Attacks.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-40154

PraisonAI is a framework for multi-agent systems and AI orchestration. While these systems can be integrated into web applications or API services that are internet-facing, they are also frequently used in internal development, research, or backend automation workflows. Since it is not inherently an edge gateway or public-facing service by default, public exposure depends entirely on the specific deployment architecture.

Praisonai

before 4.5.128

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in PraisonAI, a system for multi-agent teams, where it incorrectly treats fetched template files as trusted code without proper checks. This could allow an attacker to introduce malicious templates, potentially leading to unauthorized execution and compromise of systems that use this technology. The main concern is confirming relevance and exposure within your environment.

Trusted templates can be exploited by attackers.
Affects AI systems using fetched templates.
Verify if PraisonAI is used.

Attack Path

How an attacker could exploit the issue

An attacker could compromise PraisonAI by providing a malicious template file to the system. Since the system trusts remotely fetched templates without verifying their origin or integrity, an attacker could trick a user into loading a crafted template. This could lead to the execution of arbitrary code, potentially allowing the attacker to take control of the affected system.

No authentication or special privileges needed.
User interaction required to load template.
Leads to code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary code on systems running PraisonAI when remotely fetched template files are not properly verified. This could impact the integrity and confidentiality of system data and service behavior, depending on the template's capabilities and the system's deployment.

System data and service integrity.
Malicious templates are executed.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects PraisonAI, a multi-agent teams system. The first step for system owners is to identify all instances of PraisonAI within the environment and determine their exposure and business criticality. Following this, the accountable owner, likely the application or platform team, should be identified to coordinate remediation efforts, which may involve vendor coordination if direct patching is not feasible or immediate.

Identify PraisonAI instances and criticality.
Confirm business impact and ownership.
Plan remediation with vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework designed for orchestrating multi-agent teams. It simplifies the development and management of AI systems by allowing various agents to work together on complex tasks, often relying on template files to structure their workflows and interactions.

What does CWE-829 mean for CVE-2026-40154?

CWE-829 refers to 'Inclusion of Functionality from Untrusted Control Sphere.' In this CVE, it means the software lacks checks to verify where a template file comes from or if it has been tampered with. Because it trusts these files implicitly, it mistakenly executes malicious instructions contained within them.

How can an attacker trigger this vulnerability?

An attacker triggers this by providing a crafted, malicious template file to the system. The flaw is not triggered if the software only uses local, hardcoded templates that haven't been fetched from a remote source. It requires the system to perform a fetch operation for a template, which is then processed without verification.

Is my system at risk according to Halo Surface Signal?

PraisonAI is not inherently an edge service, so the risk depends on your specific setup. Halo Surface Signal notes that while these systems can be internet-facing, they are often used in internal research or backend automation. You should assess if your particular deployment makes the service accessible from the internet.

What should I do first to address this issue?

Begin by auditing your infrastructure to locate every instance of PraisonAI currently in use. Once identified, document which teams own these instances and determine if they handle sensitive data. This inventory will help you prioritize patching or restricting template-fetching capabilities while you coordinate a formal update.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pv9q…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.