Attack Chain

1. An attacker gains the ability to supply or influence a workflow YAML file within a PraisonAI environment. This could involve compromising a shared repository or manipulating a CI/CD pipeline.
2. The attacker crafts a malicious YAML file containing a type: job definition.
3. Within the YAML file, the attacker utilizes the run: step to inject arbitrary shell commands. Alternatively, they could use the script: step for inline Python code execution or the python: step to specify an arbitrary Python script.
4. The praisonai workflow run <file.yaml> command is executed, loading the malicious YAML file.
5. The JobWorkflowExecutor in job_workflow.py processes the YAML file.
6. The action_run() function in workflow.py is called, which in turn executes the injected code via _exec_shell(), _exec_inline_python(), or _exec_python_script() in job_workflow.py.
7. The arbitrary command or code is executed on the host system without validation or user confirmation.
8. The attacker achieves full arbitrary command execution, potentially compromising the machine, accessing sensitive data, or obtaining credentials.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the host system running PraisonAI. This can lead to complete system compromise, including unauthorized access to sensitive data, credential theft, and the potential for lateral movement within the network. The vulnerability is particularly dangerous in environments with shared workflow configurations or multi-tenant deployments. While specific victim counts are unavailable, any system running the vulnerable versions of PraisonAI or praisonaiagents is at risk, potentially leading to significant data breaches and operational disruption.

Recommendation

• Immediately upgrade PraisonAI to version 4.5.139 or later and praisonaiagents to version 1.5.140 or later to patch CVE-2026-40288.
• Deploy the Sigma rule "Detect PraisonAI Workflow YAML Execution" to your SIEM to detect potential exploitation attempts.
• Implement strict access controls and input validation for workflow YAML files to prevent unauthorized modification or injection of malicious code.
• Monitor process execution logs for suspicious commands originating from PraisonAI processes, as detected by the "Suspicious Process Execution from PraisonAI" Sigma rule.