RCE in Mervinpraison Praisonaiagents

CVE-2026-40111

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run() with shell=True at src/praisonai-agents/praisonaiagents/memor…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.000 (10.7th percentile) — read the EPSS interpretation.