MervinPraison PraisonAI arbitrary file read and write in multiedit tool

Executive brief

PraisonAI is an AI agent framework that allows automated tools to interact with a computer's filesystem. A vulnerability in the 'multiedit' tool allows an attacker to trick the AI into reading or overwriting any file on the host system. This could lead to the theft of sensitive data like SSH keys and cloud credentials, or allow an attacker to gain full control of the system by modifying critical configuration files.

Technical details

A path traversal vulnerability exists in the `multiedit` tool within `src/praisonai/praisonai/tools/multiedit.py`. The `filepath` parameter is passed directly to Python's `open()` function for both read and write operations without any validation, such as checks for '..' sequences, workspace boundary enforcement, or symlink resolution. An attacker can exploit this by providing crafted prompts or malicious YAML configurations to an AI agent, causing it to access files outside the intended directory. This allows for arbitrary file read (leaking secrets like /etc/shadow or .env files) and arbitrary file write (enabling privilege escalation). The issue is resolved in version 4.6.61.

Affected products

• MervinPraison praisonai < 4.6.61

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory
• 2026-06-18: patched: Fixed in version 4.6.61

References

• https://api.github.com/users/sondt99
• https://github.com/sondt99
• https://api.github.com/users/sondt99/gists%7B/gist_id%7D
• https://api.github.com/users/sondt99/repos
• https://avatars.githubusercontent.com/u/87920408?v=4
• https://api.github.com/users/sondt99/events%7B/privacy%7D