CVE-2026-55530: PraisonAI ast_grep_rewrite missing authorization in file modification

CVE-2026-55530 · Severity: medium · CVSS 6.1 · Published 2026-08-25

PraisonAI's ast_grep_rewrite tool allows an LLM agent to modify arbitrary files on disk using pattern-based code rewriting, bypassing the approval workflow that protects other file-modifying tools. An attacker can inject code into source files through prompt injection or LLM steering, and the modifications happen silently with no operator notification. Since rewritten files may be later imported or executed, this write primitive escalates to remote code execution under the agent's process privileges.

Technologies: praisonaiagents (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55530 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55530 being exploited in the wild.
How severe is CVE-2026-55530?
Medium severity, with a CVSS score of 6.1, published 25 August 2026.
Which products and versions are affected?
praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.58.
Is there a fix for CVE-2026-55530?
Yes. praisonaiagents (PyPI): upgrade to 1.6.58 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55530 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-55530?
Check whether you run praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonaiagents (PyPI): upgrade to 1.6.58 or later
    pip install "praisonaiagents>=1.6.58"

Technical details

The ast_grep_rewrite function in praisonaiagents/tools/ast_grep_tool.py performs arbitrary file rewrites via the ast-grep CLI tool (subprocess.run with --update-all flag). Unlike sibling mutation tools (copy_file, move_file, delete_file, edit_file, execute_command, execute_code), it lacks the @require_approval decorator that enforces an interactive approval gate before execution. With dry_run=False (LLM-controllable via the tool schema), an attacker controlling pattern, replacement, and path parameters can rewrite any file the process can write, including with path="/" for filesystem-wide mutations. The rewrite command is built unsafely without path validation checks or cwd sandboxing. A secondary defect causes the function to return "No changes made" even when files were modified, hiding the write from audit. Proof of concept demonstrates injection of arbitrary Python code into target files without any approval prompt. The vulnerability was patched in v1.6.58 by adding the @require_approval(risk_level="high") decorator, _validate_path workspace boundary checks, and corrected return-value reporting.

Affected products

  • MervinPraison PraisonAI <1.6.58

Identifiers

  • CVE-2026-55530
  • GHSA-cfxv-8fw8-rwpv
  • PYSEC-2026-3901

Timeline

  • 2026-06-13: disclosed: Initial coordinated disclosure (GitHub review date)
  • 2026-08-25: advisory: Published to GitHub Advisory Database
  • 2026-08-25: patched: Fixed in praisonaiagents 1.6.58

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.