EUVD-2026-77614
GHSA-gcq3-mfvh-3x25
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
AC raised to H because exploitation requires a specific API misuse order (CODE_TOOLS before set_workspace); no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application that exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace can therefore let prompt-influenced calls read and modify files outside the intended project directory, while explicitly configured workspaces remain effective. This vulnerability is fixed in 4.6.59.
AnalysisAI
Path traversal in PraisonAI before 4.6.59 allows prompt-influenced calls to code agent tools to read and modify arbitrary files outside any intended project boundary when an application exposes CODE_TOOLS, code_read_file, code_search_replace, or code_apply_diff before calling set_workspace(). The global _workspace_root defaults to None, and the lower-level file helpers silently skip path containment checks when workspace is falsy - a fail-open design identical to a previously patched write_file path (GHSA-hvhp-v2gc-268q). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the application uses the praisonai package's CODE_TOOLS, code_read_file, code_search_replace, or code_apply_diff agent wrappers; (2) set_workspace() has NOT been called before those tools are exposed to agents - specifically, the module-level _workspace_root remains None; and (3) a user or attacker submits a prompt that causes the agent to invoke one of the file-operation wrappers with a path outside the intended directory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-provided CVSS 7.3 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) captures worst-case impact accurately - arbitrary file read and write - but AC:L understates the deployment pre-condition: exploitation requires the application to expose CODE_TOOLS before set_workspace() is called, which the official examples explicitly avoid. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to PraisonAI 4.6.59, which applies the same fail-closed default (effective_workspace = workspace or os.getcwd()) to read_file, search_replace, and apply_diff that was previously applied only to write_file. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running PraisonAI versions before 4.6.59 and verify whether code agent tools (CODE_TOOLS, code_read_file, code_search_replace, code_apply_diff) are exposed before the set_workspace() security boundary is initialized. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today