CVE-2026-40153
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False (line 88) for security. This allows exfiltration of secrets stored in environment variables (database credentials, API keys, cloud access keys). The approval system displays the unexpanded $VAR references to human reviewers, creating a deceptive approval where the displayed command differs from what actually executes. This vulnerability is fixed in 1.5.128.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.4
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
- EPSS probability
- 0.27%
- CWE
- CWE-526
- Published
- 2026-04-09
- Last modified
- 2026-04-13
Affected products
- MervinPraison PraisonAIAgents
Weakness type
Related vulnerabilities
- CVE-2026-76227 — Renovate 42.68.1 before 42.96.3 Environment Variable Exposure
- CVE-2026-72648 — Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure
- CVE-2026-49377 — In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
- CVE-2026-45370 — python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
- CVE-2025-36105 — IBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerability
- CVE-2025-27899 — Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
- CVE-2025-36017 — IBM Controller Information Disclosure
- CVE-2025-9162 — Org.keycloak/keycloak-model-storage-service: variable injection into environment variables