CVE-2026-40111

The memory hooks executor in the file src/praisonai-agents/praisonaiagents/memory/hooks.py passes the command string directly to subprocess.run() with the shell=True option, without any sanitization. Shell metacharacters are interpreted by /bin/sh, which enables injection of arbitrary commands. There are two independent attack surfaces: the first is the pre_run_command and post_run_command hook events registered by hook configuration; the second, more serious, is the .praisonai/hooks.json configuration file, in which hooks registered for events such as BEFORE_TOOL and AFTER_TOOL are executed automatically during agent operation. An agent that gains file write access through prompt injection can overwrite .praisonai/hooks.json and cause silent execution of its payload on every subsequent lifecycle event.

An attacker can execute arbitrary system commands with the privileges of the agent process, potentially gaining full control over the system and the environment in which the application operates. In a scenario with prompt injection, it is possible to persistently execute malicious code without further user interaction.

Update PraisonAIAgents to version 1.5.128 or newer, in which the vulnerability has been fixed. References: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v7px-3835-7gjx

PraisonAI — PraisonAIAgents library in all versions before 1.5.128