CVE-2026-47394

Name of the Vulnerable Software and Affected Versions PraisonAI (affected versions not specified)

Description An incomplete security fix allows unauthenticated users to read arbitrary files from the host system. The issue stems from a dispatcher in server.py that accepts unvalidated **kwargs from the arguments parameter without enforcing the tool's declared input schema. This allows attackers to bypass containment checks in several handlers. Specifically, the praisonai.workflow.show tool can be used to return the full contents of any file the host user can read, such as SSH keys, cloud credentials, and environment files. Additionally, praisonai.workflow.validate and praisonai.deploy.validate can leak file existence and content fragments through YAML parser error messages. Other affected handlers include praisonai.audio.transcribe, praisonai.files.create, and praisonai.ocr extract. By default, the server is exposed on 127.0.0.1 with no authentication required as api key defaults to None.

Recommendations Enforce the tool.input schema in the dispatcher within mcp server/server.py to validate arguments before calling the handler. Implement per-handler containment by applying a path resolution helper to workflow show(), workflow validate(), and deploy validate() to restrict file access to allowed root directories. Restrict access to the praisonai.workflow.show, praisonai.workflow.validate, and praisonai.deploy.validate tools until a patch is applied.