EUVD-2026-44645
GHSA-f352-4x87-wmjh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable skill runner with low complexity and no UI, but invoking script execution requires existing agent privileges (PR:L); code execution yields high confidentiality and integrity impact, no direct availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.
AnalysisAI
Path-traversal remote code execution in PraisonAI (mervinpraison/praisonai) before 1.6.78 lets an authenticated agent user abuse SkillTools.run_skill_script(), which executes skill scripts without validating that the supplied path stays inside the intended working directory. Because absolute file paths are accepted, a low-privileged attacker can point the skill runner at any executable script on the host and run it. No public exploit code has been identified and it is not in CISA KEV, but the flaw was reported by VulnCheck and a GitHub Security Advisory (GHSA-c44f-37qr-gw3f) confirms the fix.
Technical ContextAI
PraisonAI is a multi-agent AI orchestration framework where 'skills' are user-defined scripts the agent can invoke as tools. The vulnerable component, SkillTools.run_skill_script(), is intended to load and execute a script from a designated skills/working directory, but it performs no path containment (canonicalization/prefix) check before execution. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): the routine trusts caller-supplied path input and resolves absolute paths verbatim, so '/etc/...' or any absolute location bypasses the intended sandbox boundary and the referenced file is executed rather than merely read. The single affected package is identified by cpe:2.3:a:mervinpraison:praisonai across all versions prior to the fixed 1.6.78 release.
RemediationAI
Vendor-released patch: upgrade PraisonAI to 1.6.78 or later, which introduces the path containment validation in run_skill_script(); this is the primary and recommended fix, per GHSA-c44f-37qr-gw3f. If immediate upgrade is not possible, apply compensating controls: restrict who can invoke skill/agent tooling by tightening the PR:L access boundary (require strong authentication and limit skill execution to trusted operators only), and where feasible run the agent under a locked-down, unprivileged service account inside a container or chroot so that even an escaped path resolves within a confined filesystem - the trade-off is that legitimate skills stored outside the sandbox will stop resolving. Additionally, treat any user-supplied skill path as untrusted and, if you maintain a fork or wrapper, reject absolute paths and canonicalize/verify the resolved path is a prefix of the intended skills directory before execution. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-skilltools) for further detail.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today