Praisonai · Praisonai · CVE-2026-55540
**Name of the Vulnerable Software and Affected Versions**
PraisonAI versions prior to 4.6.58
**Description**
PraisonAI contains path traversal flaws in its `praisonai.code` tool wrappers, which are intended to treat the `workspace` setting as a security boundary. The boundary is enforced inconsistently and unsoundly across several tools:
1. The `is path within directory()` function uses `os.path.abspath()` instead of `os.path.realpath()`. This allows a symlink located inside the workspace that points to a target outside the workspace to bypass security checks, enabling the `read file`, `write file`, `apply diff`, and `search replace` tools to access external files.
2. The `list files()` function fails to call the containment helper entirely, allowing absolute paths or `../` sequences to escape the workspace.
3. The `execute command()` and `code execute command()` functions do not validate the `cwd` (current working directory) parameter, allowing commands to be executed from directories outside the configured workspace.
An attacker capable of influencing an agent—via untrusted prompts or indirect prompt injection—can read, overwrite, list, and execute files and binaries outside the workspace, limited only by the filesystem permissions of the process user.
**Recommendations**
Update PraisonAI to version 4.6.58.
As a temporary mitigation, restrict the use of the `read file`, `write file`, `apply diff`, `search replace`, `list files`, and `execute command` tools when processing untrusted input.