Praisonaiagents CVE-2026-40117

The CVSS 6.2 score reflects the local attack vector (AV:L) and high confidentiality impact (C:H), but real-world risk is modulated by multiple factors. Attack complexity is low (AC:L) and no privileges are required (PR:N), making exploitation straightforward once local code execution or agent control is achieved. However, the practical threat relies on a two-stage attack: first, an attacker must influence the agent's behavior through prompt injection or similar vector; second, the agent must execute the read_skill_file() function with attacker-controlled parameters. The absence of public exploit code or CISA KEV confirmation indicates no active widespread exploitation, but the vulnerability is triggered by well-understood attack patterns (prompt injection in LLM-based agents). Organizations running untrusted agents or exposed to prompt injection should prioritize patching, particularly in environments where the agent processes sensitive data or runs in multi-tenant contexts. The vulnerability does not affect confidentiality of the agent process itself; rather, it enables exfiltration through an existing agent capability. SSVC perspective: exploitation is probable (prompt injection is a known agent vulnerability class), technical impact is high (confidentiality loss), and automation of post-exploitation exfiltration is straightforward once read_skill_file() is invoked.

An attacker crafts a malicious prompt that injects instructions into a PraisonAIAgents instance, causing the agent to invoke read_skill_file() with a path parameter pointing to a sensitive file (e.g., /etc/passwd, environment variable files, or application secrets) outside the intended workspace directory. Because read_skill_file() does not validate the skill_path parameter or enforce workspace boundaries, the agent successfully reads the file and returns its contents to the attacker, either through the agent's output channel or via exfiltration. This attack requires local or agent-accessible environment context but no additional authentication, making it practical for attackers who can control agent inputs through prompt injection.