https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:32:35 +0000 https://vulnerability.circl.lu/vuln/cve-2026-40117 <p><strong>Affected:</strong> MervinPraison PraisonAIAgents</p> <p>PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem by accepting an unrestricted skill_path parameter. Unlike file_tools.read_file which enforces workspace boundary confinement, and unlike run_skill_script which requires critical-level approval, read_skill_file has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt. This vulnerability is fixed in 1.5.128.</p> <p><strong>Affected:</strong> MervinPraison PraisonAIAgents</p> <p>PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem by accepting an unrestricted skill_path parameter. Unlike file_tools.read_file which enforces workspace boundary confinement, and unlike run_skill_script which requires critical-level approval, read_skill_file has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt. This vulnerability is fixed in 1.5.128.</p> https://vulnerability.circl.lu/vuln/cve-2026-40117 https://vulnerability.circl.lu/vuln/pysec-2026-2949 <p><strong>Affected:</strong> PyPI: praisonaiagents</p> <p>## Summary</p> <p>`read_skill_file()` in `skill_tools.py` allows reading arbitrary files from the filesystem by accepting an unrestricted `skill_path` parameter. Unlike `file_tools.read_file` which enforces workspace boundary confinement, and unlike `run_skill_script` which requires critical-level approval, `read_skill_file` has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt.</p> <p>## Details</p> <p>The vulnerability is a missing authorization check in `read_skill_file()` at `src/praisonai-agents/praisonaiagents/tools/skill_tools.py:128`.</p> <p>The function&#39;s path validation on line 163 only ensures `file_path` doesn&#39;t escape `skill_path` via directory traversal:</p> <p>```python # skill_tools.py:128-170 def read_skill_file(self, skill_path: str, file_path: str, encoding: str = &#39;utf-8&#39;) -&gt; str: # ... skill_path = os.path.expanduser(skill_path) # line 147 if not os.path.isabs(skill_path): skill_path = os.path.join(self._working_directory, skill_path) skill_path = os.path.abspath(skill_path) # line 150</p> <p># ... existence checks ...</p> <p>full_path = os.path.join(skill_path, file_path) # line 159 full_path = os.path.abspath(full_path) # line 160</p> <p># Security check: ensure file is within skill directory if not full_path.startswith(skill_path): # line 163 return f&#34;Error: Path traversal detected...&#34;</p> <p>with open(full_path, &#39;r&#39;, encoding=encodin…</p> <p><strong>Affected:</strong> PyPI: praisonaiagents</p> <p>## Summary</p> <p>`read_skill_file()` in `skill_tools.py` allows reading arbitrary files from the filesystem by accepting an unrestricted `skill_path` parameter. Unlike `file_tools.read_file` which enforces workspace boundary confinement, and unlike `run_skill_script` which requires critical-level approval, `read_skill_file` has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt.</p> <p>## Details</p> <p>The vulnerability is a missing authorization check in `read_skill_file()` at `src/praisonai-agents/praisonaiagents/tools/skill_tools.py:128`.</p> <p>The function&#39;s path validation on line 163 only ensures `file_path` doesn&#39;t escape `skill_path` via directory traversal:</p> <p>```python # skill_tools.py:128-170 def read_skill_file(self, skill_path: str, file_path: str, encoding: str = &#39;utf-8&#39;) -&gt; str: # ... skill_path = os.path.expanduser(skill_path) # line 147 if not os.path.isabs(skill_path): skill_path = os.path.join(self._working_directory, skill_path) skill_path = os.path.abspath(skill_path) # line 150</p> <p># ... existence checks ...</p> <p>full_path = os.path.join(skill_path, file_path) # line 159 full_path = os.path.abspath(full_path) # line 160</p> <p># Security check: ensure file is within skill directory if not full_path.startswith(skill_path): # line 163 return f&#34;Error: Path traversal detected...&#34;</p> <p>with open(full_path, &#39;r&#39;, encoding=encodin…</p> https://vulnerability.circl.lu/vuln/pysec-2026-2949