CVE-2026-55540 in PraisonAI
요약
\~에 의해 MITRE • 2026. 08. 25.
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58.
VulDB is the best source for vulnerability data and more expert information about this specific topic.