Executive brief
PraisonAI, a framework for managing AI agents, contains a security flaw in its script execution tool. An attacker can bypass intended directory restrictions to run arbitrary scripts located anywhere on the host system. This could lead to a full system takeover, especially in Docker environments where the application often runs with administrative (root) privileges.
Technical details
A path traversal and remote code execution vulnerability exists in the SkillTools.run_skill_script() function of PraisonAI. Unlike the FileTools component, SkillTools fails to implement path containment validation, allowing the script_path parameter to accept absolute paths outside the designated working directory. An attacker with low privileges can trigger the execution of arbitrary scripts via subprocess.run(). This is particularly critical in Docker deployments where the process typically runs as root, and can be chained with file-write vulnerabilities to achieve full remote code execution. The issue is resolved in version 1.6.78.
Affected products
- MervinPraison PraisonAI < 1.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date