Executive brief
PraisonAI, a system for managing multi-agent AI teams, contains a vulnerability in its Model Context Protocol (MCP) server. This flaw allows an attacker to bypass directory restrictions and write or delete arbitrary files on the user's system. By placing a malicious file in specific Python directories, an attacker can gain full control over the system, executing arbitrary code whenever the user runs a Python-based application or script.
Technical details
The PraisonAI MCP server (praisonai mcp serve) registers several file-handling tools (e.g., praisonai.rules.create, praisonai.workflow.show) that lack proper path validation or containment checks. The JSON-RPC dispatcher passes arguments directly to these handlers without validating them against the input schema. An attacker can use path traversal sequences (../../) to write files outside the intended ~/.praison/rules/ directory. By writing a malicious .pth file to the Python site-packages directory, an attacker can achieve arbitrary code execution (RCE) in any subsequent Python process spawned by the user. This can be triggered via prompt injection if an LLM is connected to the MCP server or via unauthenticated HTTP requests if the server is running with default settings. The issue is fixed in version 4.6.34.
Affected products
- MervinPraison PraisonAI < 4.6.34
Timeline
- 2026-05-03: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE-2026-44336 published to NVD