EUVD-2026-28639
GHSA-9mqq-jqxf-grvw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-handling tools by default - praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and praisonai.workflow.show. Each accepts a path or filename string from MCP tools/call arguments and joins it onto ~/.praison/rules/ (or, for workflow.show, accepts an absolute path) with no containment check. The JSON-RPC dispatcher passes params["arguments"] blind to each handler via **kwargs without validating against the advertised input schema. By setting rule_name="../../<some-path>" an attacker walks out of the rules directory and writes any file the running user can write. Dropping a Python .pth file into the user site-packages directory escalates this primitive to arbitrary code execution in any subsequent Python process the user spawns - the next praisonai CLI invocation, an IDE script run, the user's python REPL, or any background Python service. This issue has been patched in version 4.6.34.
AnalysisAI
Arbitrary file write in PraisonAI's MCP server escalates to remote code execution through path traversal when user interaction triggers malicious tool calls. The praisonai mcp serve daemon accepts attacker-controlled path arguments without validation, allowing writes outside the intended ~/.praison/rules/ directory. Attackers can drop Python .pth files into site-packages to achieve code execution in any subsequent Python process run by the victim user. CVSS 9.4 with network vector and low complexity, though exploitation requires user interaction (PR:N/UI:P). No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis, but the detailed advisory provides sufficient information for weaponization.
Technical ContextAI
PraisonAI implements a Model Context Protocol (MCP) server that exposes file-handling tools through JSON-RPC interfaces. The vulnerability stems from CWE-20 (Improper Input Validation) where the server's tool handlers (praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, praisonai.workflow.show) accept filename parameters and perform path concatenation using os.path.join or similar without canonicalization or containment checks. The JSON-RPC dispatcher passes params['arguments'] directly to handler functions via **kwargs unpacking, bypassing any schema validation that may exist in the tool definitions. Python's site-packages .pth mechanism executes arbitrary code during interpreter initialization by processing each line as executable Python or as import statements, converting a path traversal primitive into reliable code execution. This affects the PraisonAI Python package when the MCP server component is running.
RemediationAI
Upgrade to PraisonAI version 4.6.34 or later, which patches the path traversal vulnerability through input validation and path containment checks in MCP tool handlers. Installation via pip: 'pip install --upgrade praisonai>=4.6.34'. If immediate patching is not possible, implement these compensating controls with noted trade-offs: (1) Disable the MCP server component entirely by not running 'praisonai mcp serve' - this breaks MCP-dependent workflows but eliminates the attack surface. (2) Run the MCP server under a restricted user account with no write access to Python site-packages directories (typically ~/.local/lib/python*/site-packages or system /usr/lib/python*) - this prevents privilege escalation to code execution but still allows arbitrary file writes in user-writable locations, potentially corrupting application data. (3) Deploy mandatory access control (AppArmor/SELinux profiles) restricting the praisonai process from writing outside ~/.praison/ - requires kernel-level MAC support and custom profile development. Verify the patch by reviewing https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mqq-jqxf-grvw for the specific commit implementing path validation.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today