CVE-2026-39891
Template Injection in PraisonAI create_agent_centric_tools() Allows Code Execution
Publication date: 2026-04-08
Last updated on: 2026-04-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| praison | praisonai | to 4.5.114 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
PraisonAI is a multi-agent teams system. Before version 4.5.115, the function create_agent_centric_tools() returned tools that processed file content using template rendering. When user input from agent.start() was passed directly into these tools without escaping, any template expressions included in the input were executed instead of being treated as literal text. This means that malicious input could trigger unintended code execution within the template rendering process.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows execution of arbitrary template expressions from user input. According to the CVSS score of 8.8, it has high impact on confidentiality, integrity, and availability. An attacker with low privileges and no user interaction required could exploit this to execute unauthorized code, potentially leading to data breaches, system compromise, or denial of service.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade PraisonAI to version 4.5.115 or later, where the issue with template expression execution in create_agent_centric_tools() has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers to execute arbitrary system commands with the privileges of the running process, potentially leading to full system compromise, data theft, ransomware deployment, and lateral movement within networks.
Such impacts can result in unauthorized access to sensitive data, which may violate compliance requirements of common standards and regulations like GDPR and HIPAA that mandate protection of personal and health information.
Therefore, exploitation of this vulnerability could lead to breaches of confidentiality, integrity, and availability of data, undermining compliance with these regulations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the affected PraisonAI versions (≤ 4.5.114) are in use, especially if the create_agent_centric_tools() function is called with user input that is not escaped or sanitized.
To detect exploitation attempts, monitor for unusual file creation or execution of template expressions embedded in user inputs, such as commands that evaluate template syntax like {{7*7}}.
Suggested commands to detect potential exploitation or presence of the vulnerability include:
- Check the installed version of praisonai to confirm if it is vulnerable: `pip show praisonai` or inspect the version in your environment.
- Search logs or runtime output for evidence of template expression evaluation, e.g., grep for '{{' or '}}' in user inputs or logs.
- Look for files created by exploitation attempts, such as `/tmp/pwned`, using: `ls -l /tmp/pwned`.
- Monitor running processes or commands executed by the praisonai service for suspicious activity.