PT-2026-61758

CVE-2026-56833

Published

2026-06-18

Updated

2026-10-23

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions praisonai versions 3.8.1 through 4.6.58

Description The Dynamic Context module in PraisonAI allows reading files outside the configured base directory due to a path traversal issue. The module provides filesystem-backed storage for history and terminal logs through tool factories that create functions such as history search(), history tail(), history get(), terminal tail(), terminal grep(), and terminal commands(). These tools accept run id and agent id arguments, which are joined into filesystem paths without validation. An attacker or a lower-trust user can provide absolute paths or traversal sequences (e.g., ..) in the run id and agent id variables to access arbitrary .jsonl and .log files readable by the process. This can lead to the disclosure of sensitive information, including conversation history, API keys, cloud credentials, and operational data.

Recommendations For versions 3.8.1 through 4.6.58, implement the following measures:

Reject absolute paths, path separators, and traversal components in the run id and agent id variables.
Validate that the resolved path remains under the configured base directory using a method like .resolve() and .relative to().
Apply path containment checks to all history and terminal log operations, including append, read, search, clear, and export functions.
Use opaque, server-generated identifiers for run and agent IDs instead of user-supplied strings.
As a temporary mitigation, restrict access to the create history tools() and create terminal tools() factories to trusted users only.