PraisonAI Flaws Enable Template Injection and Remote Template Code Execution
Emerging Technology Risk · 2 sources · Updated 4mo ago · First seen Apr 8, 2026
PraisonAI disclosed two high-severity vulnerabilities affecting its multi-agent teams platform, both tied to unsafe handling of templates. CVE-2026-39891 affects versions before 4.5.115 and allows template injection through agent tool definitions: the create_agent_centric_tools() function returns tools that render file content as templates, so unescaped input supplied via agent.start() can cause template expressions to execute rather than be treated as plain text. The flaw is tracked as CWE-94 and carries a CVSS v3.1 score vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high impact across confidentiality, integrity, and availability.
A second issue, CVE-2026-40154, affects versions before 4.5.128 and exposes PraisonAI to remote template code execution through untrusted externally fetched template files. The advisory says the product treated remote templates as trusted executable code without integrity checks, origin validation, or user confirmation, creating a supply-chain attack path for malicious templates. That vulnerability is mapped to CWE-829 with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. PraisonAI fixed the issues in versions 4.5.115 and 4.5.128, with GitHub advisories published as GHSA-hwg5-x759-7wjg and GHSA-pv9q-275h-rh7x.
