CVE-2026-40112

OVERVIEW CVE-2026-40112 is a stored cross-site scripting (XSS) vulnerability in PraisonAI versions prior to 4.5.128. The Flask API endpoint in src/praisonai/api.py renders agent output as HTML without adequate sanitization. The vulnerability stems from the _sanitize_html function's dependency on the nh3 library, which is not included as a required dependency in the project's pyproject.toml file. When nh3 is absent during default installation, the sanitizer fails to function, leaving HTML output unfiltered. Attackers can inject malicious JavaScript through poisoned RAG data, web scraping results, or prompt injection techniques, which then executes in the browsers of users viewing the API output. SEVERITY This vulnerability carries a CVSS score of 6.1 (Medium) with a network-based attack vector requiring low complexity and no privileges. The attack requires user interaction, as victims must view the compromised API output in their browsers. The impact is limited to low-level confidentiality and integrity violations, with no availability impact. The FAUCET Risk Score of 34.0 and minimal EPSS value of 0.0003 suggest this is not currently among the most critical threats in the vulnerability landscape. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog, and it does not appear on any hot list of actively targeted CVEs. No publicly available exploit code has been reported. The issue was remedied in version 4.5.128, and organizations should prioritize patching PraisonAI installations to mitigate risk.