What is the CVSS score of CVE-2026-39305?

CVE-2026-39305 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-39305?

PraisonAI versions prior to 4.5.113 contain a critical path traversal vulnerability in the Action Orchestrator component that allows attackers to write arbitrary files to system directories,…. A patch is available.

How to fix or mitigate CVE-2026-39305?

Within 24 hours: Identify all systems running PraisonAI pip package versions before 4.5.113 using software inventory tools; isolate affected systems from production networks if immediate patching is not feasible. Within 7 days: Apply vendor-released patch to upgrade praisonai package to version 4.5.113 or later across all affected systems; validate patched version in development environment first. Within 30 days: Audit file system permissions and SSH key access logs for any unauthorized modifications; review PraisonAI agent execution logs for suspicious file write operations; implement file integrity monitoring on critical system directories.

Python CVE-2026-39305

CRITICAL

Path Traversal (CWE-22)

2026-04-06 https://github.com/MervinPraison/PraisonAI

GHSA-jfxc-v5g9-38xr

Python RCE Path Traversal

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 01:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 16, 2026 - 01:47 vuln.today

cvss_changed

Patch released

Apr 07, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 06, 2026 - 23:31 vuln.today

CVE Published

Apr 06, 2026 - 23:09 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

The Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or compromised agent) to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments (../) in the target path, malicious actions can overwrite sensitive system files or drop executable payloads on the host.

Details

Location: src/praisonai/praisonai/cli/features/action_orchestrator.py (Lines 402, 409, 423)

Vulnerable Code snippet:

python

target = workspace / step.target

In the _apply_step method, paths are constructed by concatenating the workspace path with a user-supplied step.target string: target = workspace / step.target. The code fails to resolve and validate that the final absolute path remains within the bounds of the workspace directory. When processing FILE_CREATE or FILE_EDIT actions, this flaw permits arbitrary file modification.

PoC

Construct a malicious ActionStep payload with path traversal characters:

python

from praisonai.cli.features.action_orchestrator import ActionStep, ActionType, ActionStatus
# Payload targeting a file outside the workspace
step = ActionStep(
    id="test_traversal",
    action_type=ActionType.FILE_CREATE,
    description="Malicious file write",
    target="../../../../../../../tmp/orchestrator_pwned.txt",
    params={"content": "pwned"},
    status=ActionStatus.APPROVED
)
# When the orchestrator applies this step, it writes to the traversed path
# _apply_step(step)

Impact

This is an Arbitrary File Write vulnerability. Anyone running the Action Orchestrator to apply modifications is vulnerable. A malicious prompt could trick the agent into generating a plan that overwrites critical files (e.g., ~/.ssh/authorized_keys, .bashrc) leading to Remote Code Execution (RCE) or system corruption.

AnalysisAI

Arbitrary file write via path traversal in PraisonAI's Action Orchestrator allows compromised agents to overwrite critical system files and achieve remote code execution. The vulnerability affects the praisonai pip package, where unsanitized user input in file operation targets enables directory traversal attacks using '../' sequences. Public exploit code exists with detailed proof-of-concept demonstrating overwrite of SSH keys and shell configuration files. Despite CVSS 9.0 (Critical), EPSS score is 2% (4th percentile), indicating low observed exploitation probability in the wild. Vendor patch released in version 4.5.113.

Technical ContextAI

The vulnerability exists in PraisonAI's Action Orchestrator component, a Python-based workflow automation feature that processes file system operations. The flaw manifests in the _apply_step method where Python's pathlib Path concatenation operator (/) is used without validation: 'target = workspace / step.target'. Python's Path class does not inherently prevent directory traversal when combining paths with user-controlled components. CWE-22 (Path Traversal) represents a classic input validation failure where relative path segments bypass intended directory restrictions. The vulnerable code affects FILE_CREATE and FILE_EDIT action types, which write content directly to the constructed path without checking if the resolved absolute path escapes the workspace boundary. This is a canonical example of insufficient path canonicalization - the code should use Path.resolve() to normalize the path and verify it starts with the workspace prefix before any file operations.

RemediationAI

Upgrade praisonai to version 4.5.113 or later via pip: 'pip install --upgrade praisonai>=4.5.113'. Vendor-released patch available at https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.113 addresses the path validation flaw. If immediate patching is not feasible, implement strict input validation by modifying _apply_step to resolve paths and verify containment: after 'target = workspace / step.target', add 'resolved_target = target.resolve()' and 'if not resolved_target.is_relative_to(workspace.resolve()): raise ValueError("Path traversal detected")'. This workaround prevents traversal but requires code modification (breaks vendor support). Alternative compensating control: restrict orchestrator execution to isolated containers with read-only root filesystem and explicit write permissions only to /tmp or dedicated workspace volumes - limits blast radius to container scope but reduces functionality for legitimate file operations. Disable the Action Orchestrator feature entirely if not operationally required by avoiding imports from praisonai.cli.features.action_orchestrator module. For multi-tenant deployments, ensure each workspace runs under separate user accounts with restrictive umask and mandatory access controls to prevent cross-tenant file writes even if traversal succeeds.