PraisonAI EUVD-2026-108875

Exploitation requires the application to have enabled the Dynamic Context Discovery feature and to have constructed its Agent with tools=ctx.get_tools() (from setup_dynamic_context()), so that artifact_head, artifact_tail, artifact_grep, and artifact_chunk are callable; it is NOT present in PraisonAI deployments that do not wire up these artifact helper tools. The attacker must be able to influence those tool arguments (via prompt, user, or tool-caller input) and supply the target path - typically an absolute path or a known/guessable host path such as a project .env file, cloud credential file, SSH key, source file, or prior-run terminal/history artifact. Limiting factors: disclosure is restricted to files readable by the PraisonAI process UID; the issue is read-only (no integrity or availability impact); and network/unauthenticated reachability applies only when the agent is exposed over a public chat/API surface - deployments that gate agent access behind authentication reduce this to an authenticated-attacker issue (vendor suggests PR:L).

This is a genuine but deployment-conditional confidentiality issue rather than a universally remote-exploitable critical flaw. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) treats it as network-reachable, unauthenticated, low-complexity with high confidentiality impact and no integrity/availability effect, which is consistent with CWE-22/CWE-200 arbitrary host-file read. However, the network/unauthenticated framing is contingent: the advisory itself states AV:N and PR:N apply only when an application exposes a PraisonAI agent over a network chat/API surface AND wires up ctx.get_tools() from Dynamic Context Discovery, and that authenticated deployments should score PR:L - so the real-world attack surface is narrower than the raw 7.5 suggests. No EPSS score is provided and the CVE is not in CISA KEV, so there is no signal of widespread or active exploitation; the vuln.today Decision label is 'this_week', indicating prioritized but not emergency remediation. A local PoV is documented in the GHSA (positive control plus outside-base-dir reads of head/grep/chunk), so the mechanism is demonstrably real, but this is proof-of-concept against the library - not evidence of in-the-wild use. Net: patch this week for any deployment that actually exposes Dynamic Context Discovery artifact tools to lower-trust input; for deployments that do not enable those tools or only expose them to trusted operators, real risk is substantially lower than the CVSS number implies.

An organization runs a public or multi-tenant PraisonAI chat/agent endpoint whose agent was built with tools=ctx.get_tools() from setup_dynamic_context(). A lower-trust user sends a prompt that induces the agent to call artifact_head (or artifact_tail/grep/chunk) with an absolute path such as /app/.env or ~/.ssh/id_rsa, and the tool reads and returns the file contents because no base-directory containment or artifact-metadata check is enforced. A local PoV in the advisory confirms the behavior against PyPI 4.6.58, reading a secret file placed outside the configured artifact base directory.