PraisonAI EUVD-2026-108874

Exploitation requires that the deployed application expose PraisonAI's Dynamic Context agent-callable tool factories - create_history_tools() (history_search/history_tail/history_get) or create_terminal_tools() (terminal_tail/terminal_grep/terminal_commands) - to a lower-trust prompt or caller that can supply the run_id and agent_id tool arguments. The attacker must set run_id to an absolute path or include ../ traversal in agent_id, and the target file must be reachable with the tool-imposed suffix (.jsonl for history tools, .log for terminal tools) and readable by the PraisonAI process. Limiting factors: impact is read-only (confidentiality only); only files ending in .jsonl/.log are disclosable; the vulnerability is only reachable if an operator has wired these tools into an untrusted agent surface (not an automatic default of merely installing the package); affected versions are 3.8.1 through 4.6.58 only.

The input CVSS of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity, unauthenticated read-only disclosure, which is directionally reasonable but conditional: the 'network' and 'no privileges' assumptions only hold when a PraisonAI application actually wires the Dynamic Context history/terminal tool factories (create_history_tools/create_terminal_tools) into an exposed, lower-trust agent chat/API surface - the advisory itself notes deployments requiring authenticated access should score PR:L. No EPSS score is provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; the exploitation signal rests on the vuln.today 'this_week' decision label and a vendor-supplied local proof-of-value. The GHSA advisory includes a detailed local PoV with recorded output, but it is a local filesystem-boundary demonstration (it 'does not start a server, contact a third-party target, or use real credentials'), not a verified remote weaponized exploit against a live deployment. Net: this is a credible, well-documented CWE-22 confidentiality issue worth near-term patching for anyone exposing these tools to untrusted prompts, but it is not a mass-exploited internet-wide emergency - real-world risk hinges almost entirely on whether an operator exposes the Dynamic Context tools to lower-trust callers, which is a deployment choice rather than a default guaranteed by the library.

A PraisonAI application exposes the Dynamic Context history/terminal agent tools to a public or lower-trust chat endpoint. An attacker interacting with that agent supplies a crafted run_id (an absolute path) and agent_id (containing ../) as tool arguments, causing history_tail/history_get or terminal_tail/terminal_grep to resolve to and read .jsonl/.log files outside the configured base directory - potentially disclosing conversation history, terminal output, command logs, tokens, or cloud credentials. A local PoV in the GHSA advisory confirms the path-containment bypass against PyPI 4.6.58, but it is a local demonstration, not a verified remote exploit.