CVE-2026-40113

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-40113 is an argument injection vulnerability (CWE-88) in PraisonAI, a multi-agent teams system, affecting versions prior to 4.5.128. The issue resides in the deploy.py script, which constructs a comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating the openai_model, openai_key, and openai_base values without validating for commas. Since gcloud interprets commas as separators between key-value pairs in --set-env-vars, a comma in any of these values causes the trailing text to be parsed as additional arbitrary KEY=VALUE definitions, enabling injection of unauthorized environment variables into the deployed Cloud Run service. The vulnerability has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

An attacker requires local access to the system running deploy.py, with low privileges (PR:L) and low attack complexity, and no user interaction is needed. By supplying specially crafted values containing commas for openai_model, openai_key, or openai_base—such as during a deployment process—they can inject arbitrary environment variables into the resulting Cloud Run service. This achieves high confidentiality and integrity impacts across a changed scope, potentially allowing control over service behavior, exposure of sensitive data, or modification of runtime configurations.

The GitHub Security Advisory (GHSA-fvxx-ggmx-3cjg) confirms the vulnerability is fixed in PraisonAI version 4.5.128, recommending users upgrade to this or later versions to mitigate the issue.

PraisonAI's integration with OpenAI endpoints highlights relevance to AI/ML deployments on Google Cloud Run, where compromised environment variables could alter model inference or API behaviors. No real-world exploitation has been reported.