Executive brief
PraisonAI, an AI agent framework, contains a security flaw in its FastContext feature used for searching and reading code. An attacker or a malicious AI model can bypass directory restrictions to read sensitive files, search through private data, or list directories outside of the designated project folder. This could lead to the unauthorized exposure of system configuration files or proprietary source code.
Technical details
A path traversal vulnerability exists in the FastContext feature (praisonaiagents.context.fast) of PraisonAI. The FastContextAgent.execute_tool() function fails to properly validate paths; it prepends the workspace_path only for relative paths and does not reject absolute paths or canonicalize joined paths. Consequently, tools like grep_search, glob_search, read_file, and list_directory can be manipulated via '../' sequences or absolute paths to access files outside the configured workspace. This allows an authenticated user or a model-generated function call to exfiltrate file contents or directory structures from the host system. The issue is addressed in version 1.6.78.
Affected products
- MervinPraison PraisonAI (praisonaiagents) < 1.6.78
Timeline
- 2026-06-25: advisory: Vendor GHSA published
- 2026-07-10: disclosed: NVD publication date