Executive brief
PraisonAI, an AI agent framework, contains a vulnerability that allows users to read any file on the server hosting the application. By sending a specially crafted message containing a file reference, an attacker can bypass security boundaries to access sensitive data like system passwords, private keys, and configuration files. This could lead to a full compromise of the server or the exposure of customer credentials.
Technical details
A path traversal vulnerability exists in the MentionsParser within `src/praisonai-agents/praisonaiagents/tools/mentions.py`. The `_process_file_mention` function attempts to resolve file paths relative to a workspace but falls back to treating the input as an absolute path if the relative check fails. Because there is no validation to ensure the resulting path remains within the intended workspace boundary, an attacker can use absolute paths or '..' sequences to read any file accessible to the process user. This can be triggered via chat messages (Telegram/Discord/Slack), web UI inputs, or YAML configurations. The issue is fixed in version 1.6.59 by enforcing workspace boundary checks.
Affected products
- MervinPraison (PraisonAI) praisonaiagents < 1.6.59
Timeline
- 2026-06-17: disclosed
- 2026-06-18: advisory: GHSA-2rcg-mm5h-xchx published
- 2026-06-18: patched: Version 1.6.59 released