Arbitrary file read in PraisonAI MCP server handlers (CVE-2026-47394)

An incomplete fix for CVE-2026-44336 leaves three path-handling MCP tools (`praisonai.workflow.show`, `praisonai.workflow.validate`, `praisonai.deploy.validate`) in `mcp_server/adapters/cli_tools.py` without path containment checks, allowing any caller to read arbitrary files readable by the host user. The root-cause dispatcher in `server.py:281-298` also remains unpatched, passing unsanitized `**kwargs` from MCP `tools/call` arguments directly to handler functions with no schema enforcement. No authentication is required in the default configuration, as `api_key` defaults to `None` and the auth check is gated on `if self.api_key:`. Affected versions: - <= 4.6.39 We recommend updating to: >= 4.6.40. CVSS 8.7 · our assessment: this_week Reference: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cr9-25q5-8prj Details: https://vuln.today/cve/CVE-2026-47394