CVE-2026-40113: PraisonAI PraisonAI Vulnerable To Argument Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-fvxx-ggmx-3cjg",
  "modified" : "2026-04-10T19:22:37Z",
  "published" : "2026-04-10T19:22:37Z",
  "aliases" : [ "CVE-2026-40113" ],
  "summary" : "PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars",
  "details" : "**Summary**\n\ndeploy.py constructs a single comma-delimited string for the gcloud run\ndeploy --set-env-vars argument by directly interpolating openai_model,\nopenai_key, and openai_base without validating that these values do not\ncontain commas. gcloud uses a comma as the key-value pair separator for\n--set-env-vars. A comma in any of the three values causes gcloud to\nparse the trailing text as additional KEY=VALUE definitions, injecting\narbitrary environment variables into the deployed Cloud Run service.\n\n\nGrep Commands and Evidence\n\nStep 1. Confirm the vulnerable string construction at line 150\n```\n    grep -n \"set-env-vars\\|openai_key\\|openai_base\\|openai_model\" \\\n      src/praisonai/praisonai/deploy.py\n```\n    Expected output showing unsanitized interpolation:\n    150:  '--set-env-vars', f'OPENAI_MODEL_NAME={openai_model},OPENAI_API_KEY={openai_key},OPENAI_API_BASE={openai_base}'\n\nStep 2. Confirm no comma validation exists before this line\n```\n    grep -n \"comma\\|assertNotIn\\|ValueError\\|sanitize\\|strip\\|replace\" \\\n      src/praisonai/praisonai/deploy.py\n```\n    Expected output: no results related to input validation\n\nStep 3. View the full context of the vulnerable construction\n```\n    sed -n '140,165p' \\\n      src/praisonai/praisonai/deploy.py\n```\n    This block shows the gcloud command list where the three values are\n    joined into one comma-separated string passed as a single argument\n    element. gcloud receives this string and applies its own\n    comma-based parsing, which the subprocess list form cannot prevent.\n\nStep 4. Confirm subprocess is called without shell=True\n```\n    grep -n \"subprocess\\|Popen\\|shell=\" \\\n      src/praisonai/praisonai/deploy.py\n```\n    This confirms shell=False (default), meaning the injection is at the\n    gcloud argument level, not the shell level. The comma delimiter is\n    parsed by gcloud itself, not by /bin/sh.\n\nStep 5. Confirm no existing advisory covers this file\n```\n    grep -rn \"deploy.py\\|set.env.vars\\|openai_base\" \\\n      src/praisonai/praisonai/deploy.py\n```\n\nVulnerability Description\n\nFile:\n  `src/praisonai/praisonai/deploy.py`\n\nVulnerable line:\n```\n  150: '--set-env-vars', f'OPENAI_MODEL_NAME={openai_model},OPENAI_API_KEY={openai_key},OPENAI_API_BASE={openai_base}'\n```\n\nThe three values openai_model, openai_key, and openai_base originate\nfrom environment variables or user-provided configuration and are\ninterpolated directly into a single f-string without validation.\n\nThe subprocess call uses a Python list without shell=True. This means\nthere is no shell injection. The subprocess module passes the f-string\nas one complete argument to gcloud. gcloud then applies its own internal\nparsing to the value of --set-env-vars using a comma as the delimiter.\nThis parsing is entirely outside Python's control.\n\nIf any of the three values contains a comma, gcloud splits on that comma\nand creates an additional KEY=VALUE environment variable from the text\nfollowing it. There is no error or warning from gcloud when this occurs.\n\nThe three values are attacker-controllable in any scenario where\nenvironment variables can be set before the deploy command runs. This\nincludes compromised dotenv files, poisoned CI pipeline secrets, and\nlocal developer machines where an attacker has shell access.\n\n\nProof of Concept\n```\n attacker-controlled openai_base value:\n\n    export OPENAI_API_KEY=\"sk-legitimate-key\"\n    export OPENAI_MODEL_NAME=\"gpt-4\"\n    export OPENAI_API_BASE=\"https://api.openai.com/v1,INJECTED=attacker_value\"\n```\n\nRun the deploy command. The string constructed at line 150 becomes:\n```\n    OPENAI_MODEL_NAME=gpt-4,OPENAI_API_KEY=sk-legitimate-key,OPENAI_API_BASE=https://api.openai.com/v1,INJECTED=attacker_value\n```\ngcloud parses this as four key-value pairs and creates all four as\nenvironment variables in the Cloud Run service. INJECTED=attacker_value\nis a real environment variable available to every request the service\nhandles.\n\nVerify the injection after deployment:\n```\n    gcloud run services describe praisonai-service \\\n      --region us-central1 \\\n      --format \"value(spec.template.spec.containers[0].env)\"\n```\nThe output includes INJECTED alongside the three legitimate variables.\n\nAPI key override:\n\n  `  export OPENAI_API_KEY=\"sk-real,OPENAI_API_KEY=sk-attacker\"`\n\nThe constructed string contains OPENAI_API_KEY twice. In gcloud versions\nwhere the last-defined value takes precedence, the deployed service uses\nsk-attacker for all LLM API calls. All agent traffic routes through the\nattacker-controlled API account.\n\n\n**Impact**\n\nAn attacker who can influence any of the three environment variables\nbefore deploy.py runs can inject arbitrary environment variables into\nthe deployed Cloud Run production service without triggering any error.\n\nInjection scenarios include a malicious git hook that modifies a dotenv\nfile before deployment, a compromised CI pipeline secret, or any local\naccess that allows setting environment variables in the deploy shell\nsession.\n\nConsequences include overriding the API key used by the production\nservice, injecting proxy settings that redirect all outbound LLM traffic,\nsetting debug or verbose flags that write sensitive data to Cloud Run\nlogs, and overriding any security-relevant variable the service reads\nfrom its environment.\n\nThe API key override scenario is the highest-impact case. All production\nLLM calls made by the deployed service are billed to and logged by the\nattacker's API account, giving the attacker full visibility into every\nagent prompt and response processed in production.\n\n\n**Recommended Fix**\n\nPass each variable as a separate --update-env-vars flag so each value\nis an isolated argument and gcloud never performs comma-based parsing\nacross multiple values:\n\n    Before:\n      ['gcloud', 'run', 'deploy', 'praisonai-service',\n       '--set-env-vars',\n       f'OPENAI_MODEL_NAME={openai_model},OPENAI_API_KEY={openai_key},OPENAI_API_BASE={openai_base}']\n\n    After:\n      ['gcloud', 'run', 'deploy', 'praisonai-service',\n       '--update-env-vars', f'OPENAI_MODEL_NAME={openai_model}',\n       '--update-env-vars', f'OPENAI_API_KEY={openai_key}',\n       '--update-env-vars', f'OPENAI_API_BASE={openai_base}']\n\nEach --update-env-vars element is a separate string in the subprocess\nlist. The subprocess module passes each as a distinct argument to\ngcloud. gcloud receives three separate single-variable assignments and\nperforms no cross-argument comma parsing.\n\nAdd pre-flight validation as a secondary control:\n\n    for label, value in [\n        (\"OPENAI_MODEL_NAME\", openai_model),\n        (\"OPENAI_API_KEY\", openai_key),\n        (\"OPENAI_API_BASE\", openai_base),\n    ]:\n        if \",\" in value:\n            raise ValueError(\n                f\"{label} contains a comma and would corrupt \"\n                f\"--set-env-vars: {value!r}\"\n            )\n\n\nReferences\n\nCWE-88 Improper Neutralization of Argument Delimiters in a Command\ngcloud run deploy documentation for --set-env-vars KEY=VALUE comma\ndelimiter specification",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "PraisonAI"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.5.128"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fvxx-ggmx-3cjg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40113"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.128"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-88" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-10T19:22:37Z",
    "nvd_published_at" : "2026-04-09T22:16:34Z"
  }
}