Executive brief
PraisonAI, a framework for managing AI agents, contains a vulnerability where it automatically trusts configuration files found within a project folder. If a developer opens a malicious project, the software can be tricked into overwriting sensitive files elsewhere on the computer, such as system configurations or personal data. This occurs because the tool does not verify if the file paths specified in the project's settings are restricted to the project folder itself.
Technical details
A path traversal vulnerability exists in PraisonAI (pip package praisonaiagents) before version 1.6.78. The software automatically loads default settings from a project-local `.praisonai/config.toml` file during Agent construction. The `defaults.output.output_file` parameter is not validated, allowing an attacker to specify absolute paths or '..' traversal sequences. When `agent.start()` is called without an explicit output parameter, the application writes the agent's response to the attacker-specified path, potentially overwriting arbitrary files with the privileges of the user running the script. The fix involves validating that config-sourced paths do not escape the project root.
Affected products
- MervinPraison praisonaiagents < 1.6.78
- MervinPraison PraisonAI < 1.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory GHSA-qjw5-xwrp-xwpq published
- 2026-07-10: disclosed: NVD publication date