EUVD-2026-42898
GHSA-3f4v-mp44-x4x2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low complexity; low privilege and required interaction confirmed by CVSS 4.0 PR:L/UI:P; high confidentiality impact only, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.
AnalysisAI
Path traversal in PraisonAI's FastContext feature (praisonaiagents before 1.6.78) enables low-privileged network attackers to read arbitrary files outside the intended workspace sandbox. FastContextAgent.execute_tool() applies the workspace_path prefix only to relative paths, neither rejecting absolute path arguments nor canonicalizing joined paths before enforcing containment - meaning file-operation tools (grep_search, glob_search, read_file, list_directory) can be exploited with '../' sequences or direct absolute paths to exfiltrate host files. No public exploit has been identified at time of analysis, but the vulnerability is straightforward to trigger given the mechanics, and CVSS 4.0 rates the confidentiality impact on the vulnerable system as High.
Technical ContextAI
PraisonAI is a Python-based multi-agent AI orchestration framework distributed as the praisonaiagents package (CPE: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*). The FastContext feature (praisonaiagents.context.fast module) provides workspace-scoped file operations intended to sandbox agents to a configured workspace_path. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): execute_tool() conditionally prepends workspace_path only when the supplied argument is detected as a relative path, but takes no action when an absolute path is supplied and does not canonicalize (resolve '..' components via os.path.realpath or equivalent) the resulting joined path before comparing it against the workspace boundary. Both bypass vectors - absolute path injection and '../' traversal sequences - therefore succeed unconditionally. File contents are returned directly to the caller or injected into the model's tool-result context window, making this particularly impactful in agentic pipelines where the model may autonomously generate malicious tool arguments.
RemediationAI
Upgrade praisonaiagents to version 1.6.78 or later, which resolves the path traversal per the vendor security advisory (GHSA-4xxv-6wmf-xf45) via upstream commit 1620b49f36945d8cc8ee5635b906c960df5097a0 (https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0). If immediate upgrade is not feasible, consider the following compensating controls with their trade-offs: (1) Disable the FastContext feature entirely if it is not required - this eliminates the attack surface but removes workspace-scoped file tool capabilities. (2) Restrict the agent process to a dedicated OS user account with filesystem access limited via Linux DAC or mandatory access controls (e.g., AppArmor, SELinux) to only the intended workspace directory - this limits traversal blast radius but requires OS-level configuration changes and does not fix the code defect. (3) In containerized deployments, mount only the workspace directory into the container filesystem - this is a strong containment measure but does not apply to bare-metal or VM-based deployments. Reference the vendor advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4xxv-6wmf-xf45 for authoritative remediation guidance.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today