Executive brief
PraisonAI's ast_grep_rewrite tool allows an LLM agent to modify arbitrary files on disk using pattern-based code rewriting, bypassing the approval workflow that protects other file-modifying tools. An attacker can inject code into source files through prompt injection or LLM steering, and the modifications happen silently with no operator notification. Since rewritten files may be later imported or executed, this write primitive escalates to remote code execution under the agent's process privileges.
Technical details
The ast_grep_rewrite function in praisonaiagents/tools/ast_grep_tool.py performs arbitrary file rewrites via the ast-grep CLI tool (subprocess.run with --update-all flag). Unlike sibling mutation tools (copy_file, move_file, delete_file, edit_file, execute_command, execute_code), it lacks the @require_approval decorator that enforces an interactive approval gate before execution. With dry_run=False (LLM-controllable via the tool schema), an attacker controlling pattern, replacement, and path parameters can rewrite any file the process can write, including with path="/" for filesystem-wide mutations. The rewrite command is built unsafely without path validation checks or cwd sandboxing. A secondary defect causes the function to return "No changes made" even when files were modified, hiding the write from audit. Proof of concept demonstrates injection of arbitrary Python code into target files without any approval prompt. The vulnerability was patched in v1.6.58 by adding the @require_approval(risk_level="high") decorator, _validate_path workspace boundary checks, and corrected return-value reporting.
Affected products
- MervinPraison PraisonAI <1.6.58
Timeline
- 2026-06-13: disclosed: Initial coordinated disclosure (GitHub review date)
- 2026-08-25: advisory: Published to GitHub Advisory Database
- 2026-08-25: patched: Fixed in praisonaiagents 1.6.58