EUVD-2026-42895
GHSA-rrqj-82cc-g6h4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L and PR:N because attacker influence is via a cloned repo config; UI:R since victim must run agent.start(); S:C and I:H for cross-boundary arbitrary file write; C:N as no confidentiality impact is described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.
AnalysisAI
Path traversal in PraisonAI (pip package praisonaiagents) before version 1.6.78 allows an untrusted checked-out repository to overwrite arbitrary files on a developer's machine by embedding a malicious .praisonai/config.toml that sets defaults.output.output_file to an absolute or directory-traversal path. When the developer subsequently constructs an Agent and calls agent.start() without an explicit output parameter, PraisonAI resolves the attacker-supplied path - creating parent directories as needed - and writes agent output there with the privileges of the running user. No public exploit code or CISA KEV listing has been identified; a vendor patch at version 1.6.78 and an upstream fix commit are available per GitHub Security Advisory GHSA-qjw5-xwrp-xwpq.
Technical ContextAI
PraisonAI is a Python-based AI agent orchestration framework distributed as the praisonaiagents pip package (CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*). The framework automatically discovers and loads defaults from a project-local .praisonai/config.toml file at Agent construction time. The root cause is CWE-22 (Path Traversal): the defaults.output.output_file configuration key is accepted verbatim without canonicalization or confinement to the project directory. The framework resolves whatever path the config specifies - including absolute paths such as /etc/cron.d/backdoor or traversal sequences such as ../../.ssh/authorized_keys - and writes the LLM agent response there when agent.start() is called without an overriding output argument. The automatic creation of parent directories further amplifies the primitive to include arbitrary directory creation. The attack is a supply-chain trust boundary violation: the .praisonai/config.toml file is expected to be project-controlled, but the framework does not distinguish between developer-authored and attacker-supplied project files when resolving output paths.
RemediationAI
Upgrade to praisonaiagents version 1.6.78 or later via pip install --upgrade praisonaiagents; the upstream fix is documented in commit 3aa9cbc2bd49c23a32be0a89a5e620d13d843eab (https://github.com/MervinPraison/PraisonAI/commit/3aa9cbc2bd49c23a32be0a89a5e620d13d843eab) and the full advisory is at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qjw5-xwrp-xwpq. As a compensating control before patching, inspect any .praisonai/config.toml present in a project directory before invoking PraisonAI, specifically auditing the defaults.output.output_file key for absolute paths or .. segments; deleting or blanking this key eliminates the attack surface with no impact on callers that pass output explicitly to agent.start(). For CI/CD pipelines that process untrusted repositories, run PraisonAI inside a container or VM with a restricted filesystem view - mounting only the project directory and denying writes to paths outside it - which constrains the blast radius of any traversal attempt to within the sandbox.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today