PyPI/praisonaiagents CVE-2026-40288: critical 9.8, EPSS 0.61%

PraisonAI has critical RCE via `type: job` workflow YAML

Action: Upgrade praisonaiagents to 1.5.140 or later.

pip install praisonaiagents==1.5.140

Affected

Fixed versions

Sources

• osv: PYSEC-2026-488
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vc46-vw85-3wvm
• https://nvd.nist.gov/vuln/detail/CVE-2026-40288
• https://github.com/MervinPraison/PraisonAI
• https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.139
• https://pypi.org/project/praisonaiagents
• https://github.com/advisories/GHSA-vc46-vw85-3wvm

CVE-2026-40288 · published 2026-06-29T11:50:45.951267Z · modified 2026-07-13T16:15:16.470577469Z · JSON