PraisonAI path traversal in CODE_TOOLS agent wrappers

Executive brief

PraisonAI, a framework for building AI agents, contains a vulnerability where its code-handling tools fail to restrict file access to a specific project folder by default. If an application uses these tools without explicitly setting a workspace boundary, an attacker could influence the AI agent to read or modify sensitive files anywhere on the host system. This could lead to the exposure of secret configuration files or unauthorized changes to critical system data.

Technical details

A path traversal vulnerability exists in PraisonAI's `CODE_TOOLS` wrappers, including `code_read_file`, `code_search_replace`, and `code_apply_diff`. The root cause is that `_workspace_root` is initialized to `None`, and lower-level helper functions only perform path containment checks if a workspace path is truthy. When `None` is passed, these helpers fail to validate that requested paths are within a restricted directory. An attacker can exploit this via prompt injection or by influencing agent tool calls to use absolute paths, allowing them to read or modify arbitrary files accessible to the process user. The vulnerability is addressed in version 4.6.59 by defaulting unset workspaces to the current working directory.

Affected products

• MervinPraison praisonai <= 4.6.57

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory: GitHub Advisory GHSA-gcq3-mfvh-3x25 published
• 4.6.59: patched

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D