CVE-2026-56839 in PraisonAI
Summary
by MITRE • 09/14/2026
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application that exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace can therefore let prompt-influenced calls read and modify files outside the intended project directory, while explicitly configured workspaces remain effective. This vulnerability is fixed in 4.6.59.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The identified vulnerability resides within PraisonAI, a multi-agent team system designed to facilitate complex coding tasks through coordinated artificial intelligence agents. Specifically, this flaw affects versions prior to 4.6.59 and centers on the improper handling of workspace context in code manipulation tools. The core issue stems from how the CODE_TOOLS wrappers manage the _workspace_root variable. In these earlier versions, when a user or agent initiates operations such as reading files, performing search-and-replace actions, or applying diffs without first explicitly setting a workspace via set_workspace, the internal state retains None for the workspace root directory. This null value is subsequently passed to helper functions including read_file, search_replace, and apply_diff. These helper functions are designed with security controls that enforce path containment checks only when a truthy workspace identifier is provided. Consequently, if the workspace parameter remains undefined or null, these critical safety mechanisms are bypassed entirely, leaving the system vulnerable to unrestricted file access.
From a technical perspective, this represents a classic case of missing authorization and improper input validation leading to insecure direct object references. The vulnerability allows an attacker who can influence prompts sent to the AI agents to execute commands that read or modify arbitrary files on the host machine's filesystem. Because the path containment logic is conditional upon the presence of a valid workspace context, any operation performed before this context is established operates without boundary constraints. This means that sensitive configuration files, source code outside the intended project directory, or even system-level scripts could be accessed or altered by prompt-influenced calls. The impact is particularly severe in environments where PraisonAI agents are exposed through APIs or interfaces like code_read_file, code_search_replace, and code_apply_diff prior to proper initialization of the workspace environment.
The operational impact of this vulnerability extends beyond simple data leakage. An adversary could leverage this flaw for unauthorized file modification, potentially leading to remote code execution if malicious scripts can be injected into executable locations within the filesystem. It also poses a significant risk to intellectual property and system integrity by allowing exfiltration of proprietary source code or configuration secrets stored in accessible directories. This aligns with Common Weakness Enumeration (CWE) categories such as CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes vulnerabilities where software does not properly restrict file access to intended locations. Additionally, the attack vector relates to CWE-798: Use of Hard-coded Credentials if sensitive data is accessed, and potentially CWE-436: Interpretation Conflict if the system misinterprets relative paths due to missing context.
In terms of threat modeling, this vulnerability facilitates actions consistent with MITRE ATT&CK techniques such as T1083: File and Directory Discovery, where an attacker explores the file system for sensitive information, and T1222: File Permission Modification or Exfiltration Over Network if the modified files are subsequently transmitted. The lack of enforced boundaries allows lateral movement within the host environment by manipulating critical files that control application behavior or security policies. This underscores the importance of ensuring that all tool-use functions in AI-driven systems have strict default-denial behaviors when context is missing, rather than relying on conditional checks that can be bypassed through initialization order manipulation.
To mitigate this vulnerability, organizations must immediately upgrade PraisonAI to version 4.6.59 or later, where the developers have addressed the logic error by ensuring path containment enforcement occurs regardless of whether a workspace has been explicitly set via set_workspace. For systems that cannot yet be upgraded, temporary mitigations include restricting API access to these specific code manipulation endpoints until initialization is complete and implementing network-level controls to limit outbound traffic from affected hosts. Furthermore, developers should audit other agent tools for similar patterns where security checks are conditionally applied based on optional parameters. Enforcing a strict initialization sequence that requires workspace context before any file operations can also serve as an operational safeguard. Regular penetration testing focused on prompt injection and tool-use boundary violations is recommended to identify analogous weaknesses in multi-agent architectures.