PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.6.59
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
PraisonAI, a multi-agent teams system, is affected through its Dynamic Context history and terminal-log tools, which can let a lower-trust user or prompt read arbitrary .jsonl and .log files on the host filesystem outside the intended storage directory. This exposes potentially sensitive data that should have been restricted to the configured context storage.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- MervinPraison PraisonAI
From 3.8.1 · fixed in 4.6.59
- praisonaiPyPI
From 3.8.1 · fixed in 4.6.59