https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T13:23:20.277450+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-40113 CVE-2026-40113 — PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars 2026-10-09T13:23:20.309582+00:00

Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for --set-env-vars. A comma in any of the three values causes gcloud to parse the trailing text as additional KEY=VALUE definitions, injecting arbitrary environment variables into the deployed Cloud Run service. This vulnerability is fixed in 4.5.128.

 https://cve.radiocsirt.org/vuln/ghsa-fvxx-ggmx-3cjg GHSA-fvxx-ggmx-3cjg — PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-e… 2026-10-09T13:23:20.309648+00:00

Affected: PyPI: PraisonAI

**Summary**

deploy.py constructs a single comma-delimited string for the gcloud run deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these values do not contain commas. gcloud uses a comma as the key-value pair separator for --set-env-vars. A comma in any of the three values causes gcloud to parse the trailing text as additional KEY=VALUE definitions, injecting arbitrary environment variables into the deployed Cloud Run service.

Grep Commands and Evidence

Step 1. Confirm the vulnerable string construction at line 150 ``` grep -n "set-env-vars\|openai_key\|openai_base\|openai_model" \ src/praisonai/praisonai/deploy.py ``` Expected output showing unsanitized interpolation: 150: '--set-env-vars', f'OPENAI_MODEL_NAME={openai_model},OPENAI_API_KEY={openai_key},OPENAI_API_BASE={openai_base}'

Step 2. Confirm no comma validation exists before this line ``` grep -n "comma\|assertNotIn\|ValueError\|sanitize\|strip\|replace" \ src/praisonai/praisonai/deploy.py ``` Expected output: no results related to input validation

Step 3. View the full context of the vulnerable construction ``` sed -n '140,165p' \ src/praisonai/praisonai/deploy.py ``` This block shows the gcloud command list where the three values are joined into one comma-separated string passed as a single argument element. gcloud receives this string and applies its own comma-based parsing,…