Executive brief
PraisonAI, an AI agent framework, contains a security flaw in how it gathers project files to provide context to AI models. An attacker can create a malicious project file that tricks the system into reading sensitive files from the host computer, such as configuration files or private keys, and sending them to the AI model or the user. This could lead to the unauthorized exposure of private data if a user is convinced to run the tool on a malicious repository.
Technical details
A path traversal vulnerability exists in the `praisonai.ui.context.ContextGatherer` component of PraisonAI. The root cause is the unsafe use of `os.path.join()` when processing `.praisoncontext` and `.praisoninclude` files; in Python, if an argument to `os.path.join` is an absolute path, all previous components are discarded, and parent directory sequences (`../`) are not normalized or restricted. An attacker who can provide a malicious workspace can use these files to force the application to read arbitrary files outside the intended project root. The gathered file contents are then appended to the context bundle sent to the AI model or displayed to the user. This requires the victim to execute the context gathering process on a malicious workspace. The issue is fixed in version 4.6.78.
Affected products
- MervinPraison PraisonAI < 4.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date