{"action":"Upgrade praisonaiagents to 1.5.128 or later.","affected":[{"fixed":"1.5.128","introduced":"0"}],"component":"praisonaiagents","cve_ids":["CVE-2026-40117"],"ecosystem":"PyPI","epss":0.00338,"exploited":false,"fixed_versions":["1.5.128"],"ghsa_id":"GHSA-grrg-5cg9-58pf","id":"tcs_01M5KH2H9SRNPW0ZHRNMM5Y4KS","modified_at":"2026-07-13T16:33:06.714096197Z","published_at":"2026-07-13T14:36:51.198789Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2949","https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-grrg-5cg9-58pf","https://nvd.nist.gov/vuln/detail/CVE-2026-40117","https://github.com/MervinPraison/PraisonAI","https://pypi.org/project/praisonaiagents","https://github.com/advisories/GHSA-grrg-5cg9-58pf"],"severity":{"label":"medium","score":6.2},"sources":[{"source":"osv","source_id":"PYSEC-2026-2949","url":"https://osv.dev/vulnerability/PYSEC-2026-2949"}],"summary":"PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate"}