CVE-2026-40111
Command Injection in PraisonAIAgents Memory Hooks Enables Persistent RCE
Publication date: 2026-04-09
Last updated on: 2026-04-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| praison | praisonaiagents | to 1.5.128 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in PraisonAIAgents, a multi-agent teams system, in versions prior to 1.5.128. The memory hooks executor passes a user-controlled command string directly to subprocess.run() with shell=True without any sanitization. This means shell metacharacters are interpreted by /bin/sh before the command executes.
There are two attack surfaces: one via pre_run_command and post_run_command hook event types configured through hooks, and a more severe one via the .praisonai/hooks.json lifecycle configuration. An attacker who gains file-write access through prompt injection can overwrite this hooks.json file, causing their payload to execute silently at every lifecycle event without further user interaction.
This vulnerability allows arbitrary command execution triggered automatically during agent operation.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in PraisonAIAgents version 1.5.128. Immediate mitigation involves upgrading to version 1.5.128 or later.
Additionally, restrict file-write access to the .praisonai/hooks.json lifecycle configuration file to prevent unauthorized modification that could lead to silent execution of malicious payloads.
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary code execution with low privileges but high impact, as malicious commands can be run silently and automatically during agent lifecycle events.
An attacker who exploits this can execute unauthorized commands, potentially leading to data compromise, system manipulation, or further escalation of privileges.