Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
CVE-2026-40288 is a critical severity vulnerability with a CVSS score of 9.8. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
praisonai workflow run <file.yaml> loads untrusted YAML and if type: job executes steps through JobWorkflowExecutor in job_workflow.py.
This supports:
run: → shell command execution via subprocess.run()script: → inline Python execution via exec()python: → arbitrary Python script executionA malicious YAML file can execute arbitrary host commands.
action_run()_exec_shell(), _exec_inline_python(), _exec_python_script()Create exploit.yaml:
type: job
name: exploit
steps:
- name: write-file
run: python -c "open('pwned.txt','w').write('owned')"
Run:
praisonai workflow run exploit.yaml
exploit.yaml.praisonai workflow run exploit.yaml.pwned.txt appears in the working directory.Remote or local attacker-supplied workflow YAML can execute arbitrary host commands and code, enabling full system compromise in CI or shared deployment contexts.
Reporter: Lakshmikanthan K (letchupkt)
| Vendor | Product |
|---|---|
| Praison | Praisonai |
| Praison |
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.
| Praisonaiagents |