Executive brief
PraisonAI is an AI agent framework with built-in code execution tools that operate within a configured workspace directory to isolate untrusted agent operations. However, multiple path-handling flaws allow an attacker to read, write, list, and execute commands outside this boundary—including via symlinks that bypass file path checks, path traversal sequences that are not validated in directory listing, and unvalidated working directories in command execution. An attacker who can feed prompts to an agent or expose it over a network can access files anywhere on the system that the application process can reach.
Technical details
The vulnerability comprises three distinct path-traversal flaws in PraisonAI's agent tool wrappers (read_file, write_file, apply_diff, search_replace, list_files, execute_command). First, the containment check in is_path_within_directory() uses os.path.abspath() instead of realpath()/Path.resolve(), which does not canonicalize symlinks; a symlink inside the workspace pointing outside passes the check but is followed by open(), allowing arbitrary file read/write. Second, list_files() does not validate paths against the workspace boundary at all—relative paths with ../ and absolute paths bypass directly. Third, execute_command() and code_execute_command() never validate the working directory (cwd) against the workspace boundary, allowing an attacker to run binaries from outside the configured directory. Exploitation requires the ability to influence agent prompts or direct prompt injection, or access to a server-exposed agent. Command execution is limited to subprocess.run() without shell=True (no metacharacter injection), but arbitrary binaries can be executed with attacker-chosen arguments from an escaped working directory. Patch version 4.6.58 is available.
Affected products
- PraisonAI PraisonAI < 4.6.58
Timeline
- 2026-06-13: disclosed: Published in GitHub Advisory Database
- 2026-08-25: advisory: Updated advisory on GitHub
- 2026-08-25: patched: Version 4.6.58 released with fix