Loading vulnerability…
Remote Template Trust / Supply Chain Code Execution in PraisonAI
CVE-2026-40154 affects PraisonAI, a multi-agent teams system. In versions prior to 4.5.128, PraisonAI treats remotely fetched template files as trusted executable code without performing integrity verification, origin validation, or requiring user confirmation before use. This unsafe trust model allows an attacker to introduce a malicious template through a remote source and have it executed as if it were legitimate application content. The issue is effectively a supply-chain style code execution risk arising from inclusion and execution of functionality from an untrusted control sphere. The vulnerability is fixed in PraisonAI 4.5.128.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to leverage malicious remotely hosted templates to execute attacker-controlled logic within the PraisonAI context. This can enable supply chain compromise outcomes including unauthorized code execution, manipulation of agent behavior or workflows, and compromise of confidentiality and integrity. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) indicates high confidentiality and integrity impact, no privileges required, network-reachable attack conditions, and user interaction as part of exploitation, with no stated availability impact.
If you can’t patch tonight, do this now.
Until upgrading, avoid using remotely fetched templates from untrusted or unaudited sources. Restrict or disable remote template retrieval where possible, allow only explicitly trusted template origins, and require manual review/approval of templates before execution. Apply integrity controls such as pinned hashes or signed templates if operationally feasible.
Patch, then assume compromise.
Upgrade PraisonAI to version 4.5.128 or later, which fixes the vulnerable handling of remotely fetched templates. Ensure deployments no longer automatically trust or execute remote templates without validation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.