EUVD-2026-21164
GHSA-grrg-5cg9-58pf
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem by accepting an unrestricted skill_path parameter. Unlike file_tools.read_file which enforces workspace boundary confinement, and unlike run_skill_script which requires critical-level approval, read_skill_file has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt. This vulnerability is fixed in 1.5.128.
AnalysisAI
PraisonAIAgents versions prior to 1.5.128 allow unauthenticated local attackers to read arbitrary files from the filesystem via the read_skill_file() function in skill_tools.py, which lacks the workspace boundary protections and approval requirements enforced by comparable file access functions. An agent subjected to prompt injection can exfiltrate sensitive files without user awareness or approval prompts, enabling confidentiality compromise with CVSS 6.2 (local attack vector, high confidentiality impact). No public exploit code or active exploitation has been reported at the time of analysis.
Technical ContextAI
PraisonAIAgents is a multi-agent orchestration framework that provides agents with file manipulation capabilities. The vulnerability stems from CWE-862 (Missing Authorization) in the read_skill_file() function within skill_tools.py. Unlike the framework's file_tools.read_file() function, which enforces workspace directory confinement to prevent directory traversal, and unlike run_skill_script() which requires critical-level user approval before execution, read_skill_file() accepts an unrestricted skill_path parameter without path validation or approval gatekeeping. This architectural inconsistency allows an attacker controlling agent behavior through prompt injection to bypass confidentiality protections. The vulnerability is accessible via local attack vector (AV:L) with no authentication required (PR:N), meaning any local process or prompt-injected agent instance can invoke the vulnerable function.
RemediationAI
Vendor-released patch: PraisonAIAgents version 1.5.128 and later. Upgrade immediately to version 1.5.128 or later to apply the fix. In the interim, organizations unable to upgrade should implement compensating controls such as restricting agent execution to isolated environments, implementing strict input validation on all user prompts to prevent prompt injection, and limiting agent access to sensitive files via host-level filesystem permissions. Detailed remediation guidance is available in the vendor advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-grrg-5cg9-58pf.
More in Praisonaiagents
View allSSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary she
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call n
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAIAgents multi-agent system allows authenticated attackers to force internal netwo
Environment variable exfiltration in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated remote attackers t
Server-Side Request Forgery (SSRF) in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated attackers to mani
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today