PT-2026-81329 · Praisonai · Praisonai
CVSS v3.1
7.1
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
PraisonAI versions prior to 4.6.58
Description
PraisonAI contains path traversal flaws in its
praisonai.code tool wrappers, which are intended to treat the workspace setting as a security boundary. The boundary is enforced inconsistently and unsoundly across several tools:- The
is path within directory()function usesos.path.abspath()instead ofos.path.realpath(). This allows a symlink located inside the workspace that points to a target outside the workspace to bypass security checks, enabling theread file,write file,apply diff, andsearch replacetools to access external files. - The
list files()function fails to call the containment helper entirely, allowing absolute paths or../sequences to escape the workspace. - The
execute command()andcode execute command()functions do not validate thecwd(current working directory) parameter, allowing commands to be executed from directories outside the configured workspace.
An attacker capable of influencing an agent—via untrusted prompts or indirect prompt injection—can read, overwrite, list, and execute files and binaries outside the workspace, limited only by the filesystem permissions of the process user.
Recommendations
Update PraisonAI to version 4.6.58.
As a temporary mitigation, restrict the use of the
read file, write file, apply diff, search replace, list files, and execute command tools when processing untrusted input.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Praisonai