Loading vulnerability…
Template Injection in PraisonAI create_agent_centric_tools
CVE-2026-39891 affects PraisonAI, a multi-agent teams system, in versions prior to 4.5.115. The flaw is in create_agent_centric_tools(), which returns tools such as acp_create_file that process file content using template rendering. When user-controlled input supplied via agent.start() is passed directly into these tools without proper escaping, template expressions embedded in that input are evaluated instead of being handled as literal text. This results in server-side template injection / code-generation-style injection behavior in the tool-processing path.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker with the ability to supply input to the affected agent workflow to cause unintended execution of template expressions during file-content processing. Based on the provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the impact is high across confidentiality, integrity, and availability, potentially enabling unauthorized access to sensitive data, modification of generated or written content, and disruption of service or application behavior.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, avoid passing untrusted or externally influenced input directly into agent-centric tools that render templates, including tools such as acp_create_file. Apply strict input validation and escaping for template metacharacters, disable or restrict template expression evaluation where feasible, and limit which users or components can invoke the affected agent workflows until the fixed version is deployed.
Patch, then assume compromise.
Upgrade PraisonAI to version 4.5.115 or later, which fixes the issue. Ensure that any user-controlled data passed from agent.start() into tools returned by create_agent_centric_tools() is treated as untrusted input and is properly escaped or otherwise prevented from being interpreted as template syntax.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.