Executive brief
PraisonAI is a multi-agent AI system that allows agents to read and modify files on a system. Prior to version 4.6.59, code helper functions (read_file, search_replace, apply_diff) failed to properly restrict file access when the workspace was not initialized, allowing an attacker to read and modify arbitrary files outside the intended project directory through prompt injection attacks.
Technical details
The vulnerability is a path traversal flaw in the CODE_TOOLS wrappers. The root cause is that _workspace_root is initialized as None and passed to read_file, search_replace, and apply_diff helpers, which only enforce path containment checks when workspace is truthy. This means an application exposing these code tools before calling set_workspace can be exploited via prompt-influenced calls to access files outside the intended project directory. An attacker can read sensitive files or modify critical system files if the application runs with elevated privileges. The vulnerability requires network access to the PraisonAI application and is fixed in version 4.6.59.
Affected products
- MervinPraison PraisonAI prior to 4.6.59
Timeline
- 2026-09-14: disclosed
- 2026-06-17: patched: Fixed in version 4.6.59