CVE-2026-57145 in PraisonAI
Summary
by MITRE • 09/14/2026
PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read files through edit and diff behavior or overwrite files accessible to the process, exposing secrets and enabling persistence or application tampering. This issue is fixed in 4.6.62.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in PraisonAI versions prior to 4.6.62 represents a critical path traversal and arbitrary file write flaw rooted in insufficient input validation within the multiedit tooling component. As a multi-agent system, PraisonAI relies on Large Language Model agents to autonomously perform tasks, including code editing and documentation updates. The core technical deficiency lies in how the application handles the filepath parameter passed from these LLM-controlled agents. Specifically, the source file src/praisonai/praisonai/tools/multiedit.py directly invokes Python's built-in open function for both reading and writing operations without implementing any safeguards against directory traversal attacks or validating that the target path resides within an expected workspace boundary. This architectural oversight allows an attacker who can influence the LLM prompt to dictate arbitrary file paths, bypassing standard security controls such as symlink resolution checks and protected-path restrictions.
From a technical perspective, this flaw enables two distinct categories of malicious activity depending on whether the operation is read or write oriented. In the context of reading files, an agent influenced by a crafted prompt can utilize the edit and diff behaviors to access sensitive system files that are outside the intended scope of the application's workspace. This effectively constitutes an unauthorized information disclosure vulnerability where confidential data, including environment variables, configuration secrets, or source code containing credentials, can be exfiltrated through the output of the editing tools. The lack of traversal rejection means that sequences such as ../ can be used to escape the designated directory structure and access root-level files on Linux systems or equivalent critical directories on other operating systems.
The write capability presents an even more severe risk vector involving arbitrary file overwrite capabilities. By controlling the filepath parameter, a prompt-influenced agent can target any file accessible by the process user account for writing purposes. This allows for the overwriting of existing system files, configuration scripts, or application binaries. The operational impact is profound as it facilitates persistence mechanisms where an attacker could plant malicious scripts or backdoors that execute upon subsequent system interactions. Furthermore, this capability enables direct application tampering, allowing adversaries to modify core logic, inject malware payloads into legitimate codebases, or disrupt service availability by corrupting critical data files. This aligns with the MITRE ATT&CK technique of File and Directory Information Discovery for reconnaissance and Command and Scripting Interpreter for persistence if executable scripts are targeted.
In terms of industry standard classifications, this vulnerability maps directly to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The failure to enforce workspace boundaries also relates to CWE-732: Incorrect Permission Assignment for Critical Resource, although the primary issue is the lack of validation rather than just permission settings. Additionally, because the attack vector relies on manipulating the input provided by an AI agent based on user prompts or external data sources, it intersects with risks associated with insecure design in generative AI applications where trust boundaries between human users and autonomous agents are blurred. The ability to read arbitrary files also touches upon CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Mitigation strategies must focus on strict input validation and sandboxing principles. The immediate remediation, as provided in version 4.6.62, involves implementing robust checks before any file operation is executed. Developers should enforce a whitelist approach where only files within the designated workspace directory are permitted for access. This requires resolving all symbolic links to their real paths and comparing them against an allowed base directory prefix to prevent traversal attacks. Furthermore, it is advisable to implement chroot jails or containerized environments with restricted filesystem permissions to limit the blast radius of any successful exploitation. For existing deployments not yet upgraded, restricting the user privileges under which PraisonAI runs can reduce the impact by limiting access to sensitive system files and critical application binaries. Regular auditing of agent behaviors and implementing guardrails that restrict file I/O operations to predefined scopes are essential steps in securing multi-agent AI systems against prompt-injection induced vulnerabilities.