Detections
Analytics

SCA: security update for praisonaiagents (GHSA-v7px-3835-7gjx)

critical Tenable Cloud Security Plugin ID 478656

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in
 praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at
 src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed and shell
 metacharacters are interpreted by /bin/sh before the intended command executes. Two independent attack
 surfaces exist. The first is via pre_run_command and post_run_command hook event types registered through
 the hooks configuration. The second and more severe surface is the .praisonai/hooks.json lifecycle
 configuration, where hooks registered for events such as BEFORE_TOOL and AFTER_TOOL fire automatically
 during agent operation. An agent that gains file-write access through prompt injection can overwrite
 .praisonai/hooks.json and have its payload execute silently at every subsequent lifecycle event without
 further user interaction. This vulnerability is fixed in 1.5.128. (CVE-2026-40111)

Solution

Update the praisonaiagents library and its related packages to version 1.5.128 or later.

See Also

https://github.com/advisories/GHSA-v7px-3835-7gjx

Plugin Details

Severity: Critical

ID: 478656

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 11/8/2026

Updated: 11/8/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-40111

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8.5

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/10/2026

Vulnerability Publication Date: 4/9/2026

Reference Information

CVE: CVE-2026-40111

cwe: CWE-78