CVE-2026-39891: 
Python vulnerability analysis and mitigation

CVE-2026-39891 is a Server-Side Template Injection (SSTI) vulnerability in PraisonAI, a multi-agent AI framework, that allows authenticated attackers to execute arbitrary code via crafted agent instructions. It affects all versions of the praisonai pip package up to and including 4.5.114, and was published on April 7–8, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Security Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the create_agent_centric_tools() function returns tools such as acp_create_file that render file content using a template engine (Jinja2). User input supplied via agent.start() is passed directly into these tools without sanitization or escaping, so template expressions embedded in the input (e.g., {{ ... }}) are evaluated server-side rather than treated as literal text. Exploitation is further facilitated by the ACP-enabled runtime's approval_mode="auto" setting, which auto-approves file operations without manual review. A low-privileged authenticated user with access to agent.start() is the only precondition for exploitation (GitHub Advisory, Security Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary system commands with the privileges of the running PraisonAI process, resulting in full compromise of confidentiality, integrity, and availability. Attackers can read or exfiltrate sensitive files, modify or delete arbitrary files, deploy ransomware, or use the compromised host as a pivot point for lateral movement within the network (GitHub Advisory, Security Advisory).

A public proof-of-concept (PoC) exploit is available in the official security advisory, demonstrating RCE via a crafted agent.start() payload (Security Advisory). The EPSS score is approximately 0.023% (0.047% per Feedly), placing it in the 7th percentile for near-term exploitation likelihood. There is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time (GitHub Advisory).

1. Gain authenticated access: Obtain low-privileged credentials or access to a PraisonAI deployment running version ≤ 4.5.114 with ACP tools enabled.
2. Identify the vulnerable entry point: Confirm that the target uses create_agent_centric_tools() (e.g., acp_create_file) and that approval_mode="auto" is configured, as seen in agent_centric_example.py.
3. Craft a malicious template payload: Construct an agent instruction containing a Jinja2 template expression that executes an OS command, for example:

   result = agent.start('Create file with content: {{ self.__init__.__globals__.__builtins__.__import__("os").system("touch /tmp/pwned") }}')

4. Submit the payload via agent.start(): Pass the crafted string as the agent instruction. The template engine evaluates the expression server-side without sanitization.
5. Confirm code execution: Verify that the injected command was executed (e.g., /tmp/pwned file is created on the server). Use more impactful payloads (reverse shell, data exfiltration) as needed. (Security Advisory)

• File System: Unexpected files created in /tmp/ or other writable directories (e.g., /tmp/pwned); new scripts or web shells written by the PraisonAI process user.
• Process: Unusual child processes spawned by the PraisonAI Python process (e.g., /bin/sh, bash, curl, wget, python) executing OS commands.
• Logs: Application logs showing agent.start() calls with inputs containing {{ or }} template delimiters; Jinja2 rendering errors or unexpected template evaluation output in application logs.
• Network: Unexpected outbound connections from the PraisonAI host to external IPs, particularly if a reverse shell payload was used. (Security Advisory)

Upgrade the praisonai pip package to version 4.5.115 or later, which contains the fix for this vulnerability (PraisonAI v4.5.115). As interim mitigations, implement strict whitelist validation and contextual escaping (e.g., Jinja2 autoescape=True) for all user-controlled content passed to template-rendering tools, restrict template execution using sandboxed eval modes, and change approval_mode from "auto" to require manual approval for file creation operations in production environments (GitHub Advisory).

The vulnerability received coverage from The Hacker Wire, which published a dedicated technical article on the template injection issue (The Hacker Wire). Additional coverage appeared on Yazoul.net's advisory tracker and social media platforms including Mastodon and Bluesky. The vulnerability was also detected by Qualys scanners (detection ID 5010637), indicating integration into commercial vulnerability management tooling (Feedly).