Executive brief
PraisonAI's Dynamic Context module manages agent history and terminal logs on disk. A path traversal vulnerability allows lower-privileged users or prompts calling the history and terminal tools to read arbitrary .jsonl and .log files outside the configured storage directory by manipulating run_id and agent_id parameters. An attacker with access to these tools could disclose sensitive data stored elsewhere on the system.
Technical details
The vulnerability exists in HistoryStore._get_history_path() and TerminalLogger._get_log_path() in src/praisonai/praisonai/context/history_store.py and src/praisonai/praisonai/context/terminal_logger.py. These functions construct filesystem paths by joining user-controlled run_id and agent_id parameters without validating that the resolved path remains under the configured base_dir. An attacker can pass an absolute path for run_id or use .. sequences in agent_id to escape the base directory and read files like /etc/passwd or other sensitive .jsonl/.log files. The tools history_tail(), history_get(), history_search(), terminal_tail(), terminal_grep(), and terminal_commands() pass caller-supplied run_id and agent_id directly to these path functions without allowlist validation or relative_to() checks. A patch is available in version 4.6.59 and later.
Affected products
- PraisonAI PraisonAI >= 3.8.1, <= 4.6.58
Timeline
- 2026-06-18: disclosed: Advisory GHSA-22cj-m4wf-fv2c published