CVE-2026-44336: MervinPraison PraisonAI path traversal and RCE in MCP server

CVE-2026-44336 · Severity: critical · CVSS 9.6 · Published 2026-05-08

PraisonAI, a system for managing multi-agent AI teams, contains a vulnerability in its Model Context Protocol (MCP) server. This flaw allows an attacker to bypass directory restrictions and write or delete arbitrary files on the user's system. By placing a malicious file in specific Python directories, an attacker can gain full control over the system, executing arbitrary code whenever the user runs a Python-based application or script.

Technologies: Praisonai, praisonai (PyPI). Vendors: Praison, PyPI.

Quick answers

Is CVE-2026-44336 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44336 being exploited in the wild.
How severe is CVE-2026-44336?
Critical severity, with a CVSS score of 9.6, published 8 May 2026.
Which products and versions are affected?
praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.34.
Is there a fix for CVE-2026-44336?
Yes. praisonai (PyPI): upgrade to 4.6.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44336 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44336?
Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai (PyPI): upgrade to 4.6.34 or later
    pip install "praisonai>=4.6.34"

Technical details

The PraisonAI MCP server (praisonai mcp serve) registers several file-handling tools (e.g., praisonai.rules.create, praisonai.workflow.show) that lack proper path validation or containment checks. The JSON-RPC dispatcher passes arguments directly to these handlers without validating them against the input schema. An attacker can use path traversal sequences (../../) to write files outside the intended ~/.praison/rules/ directory. By writing a malicious .pth file to the Python site-packages directory, an attacker can achieve arbitrary code execution (RCE) in any subsequent Python process spawned by the user. This can be triggered via prompt injection if an LLM is connected to the MCP server or via unauthenticated HTTP requests if the server is running with default settings. The issue is fixed in version 4.6.34.

Affected products

  • MervinPraison PraisonAI < 4.6.34

Identifiers

  • CVE-2026-44336
  • GHSA-9mqq-jqxf-grvw
  • PYSEC-2026-472

Timeline

  • 2026-05-03: advisory: GitHub Security Advisory published
  • 2026-05-08: disclosed: CVE-2026-44336 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.