Vulnerability-Lookup

CVE-2026-55540 (GCVE-0-2026-55540)

Vulnerability from cvelistv5 – Published: 2026-08-25 14:54 – Updated: 2026-08-27 15:19

Title

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Summary

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-27 15:18 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/MervinPraison/PraisonAI/securi…	x_refsource_CONFIRM
https://github.com/MervinPraison/PraisonAI/commit…	x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
MervinPraison	PraisonAI	Affected: < 4.6.58	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55540",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T15:18:46.761842Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T15:19:10.382Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.58"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T14:54:32.407Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8"
        },
        {
          "name": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
        },
        {
          "name": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
        }
      ],
      "source": {
        "advisory": "GHSA-ch89-h4r2-c8f8",
        "discovery": "UNKNOWN"
      },
      "title": "PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55540",
    "datePublished": "2026-08-25T14:54:32.407Z",
    "dateReserved": "2026-06-16T23:01:04.074Z",
    "dateUpdated": "2026-08-27T15:19:10.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55540",
      "date": "2026-09-26",
      "epss": "0.00394",
      "percentile": "0.30922"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "PraisonAI",
                "vendor": "MervinPraison",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.6.58"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58."
          }
        ],
        "id": "CVE-2026-55540",
        "lastModified": "2026-09-09T21:07:31.353",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55540",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T15:18:46.761842Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-25T15:16:34.740",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55540",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-27T15:18:46.761842Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-27T15:19:04.067Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "PraisonAI",
              "vendor": "MervinPraison",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.6.58"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-25T14:54:32.407Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8"
            },
            {
              "name": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
            },
            {
              "name": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
            }
          ],
          "source": {
            "advisory": "GHSA-ch89-h4r2-c8f8",
            "discovery": "UNKNOWN"
          },
          "title": "PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55540",
        "datePublished": "2026-08-25T14:54:32.407Z",
        "dateReserved": "2026-06-16T23:01:04.074Z",
        "dateUpdated": "2026-08-27T15:19:10.382Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55540

Vulnerability from fkie_nvd - Published: 2026-08-25 15:16 - Updated: 2026-09-09 21:07

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
	security-advisories@github.com	https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
	security-advisories@github.com	https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.58"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58."
    }
  ],
  "id": "CVE-2026-55540",
  "lastModified": "2026-09-09T21:07:31.353",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55540",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-27T15:18:46.761842Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-25T15:16:34.740",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CH89-H4R2-C8F8

Vulnerability from github – Published: 2026-08-25 14:54 – Updated: 2026-08-25 14:54

Summary

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Details

Summary

PraisonAI's praisonai.code tool wrappers (exported as CODE_TOOLS for agents) expose a workspace setting that the module itself treats as a path-traversal security boundary — read_file, write_file, apply_diff, and search_replace explicitly call is_path_within_directory() and return "… is outside the workspace" on violations. That boundary is enforced unsoundly and inconsistently:

The containment helper uses os.path.abspath(), not realpath()/Path.resolve(). A symlink located inside the workspace whose target is outside has an abspath() that is still inside the workspace, so it passes the check while open() follows the link. This bypasses read, write, apply_diff, and search_replace (CWE-59).
list_files() resolves path against the workspace but never calls the containment helper at all — ../ and absolute paths escape directly (CWE-22).
execute_command() takes a workspace argument documented "for security validation" but performs no cwd containment check; code_execute_command() resolves a relative cwd against the workspace and also never validates it (and never even passes workspace to the low-level helper). A relative cwd="../outside" runs commands from outside the workspace (CWE-22). An attacker who can influence an agent that has these tools attached (untrusted prompt, indirect prompt injection, or a server-exposed agent) can read, overwrite, list, and execute from outside the configured workspace, bounded only by the process user's filesystem permissions.

Technical Detail

1. Unsound containment helper (symlink bypass — CWE-59)

# src/praisonai/praisonai/code/utils/file_utils.py — is_path_within_directory()
abs_file = os.path.abspath(file_path)     # does NOT resolve symlinks
abs_dir  = os.path.abspath(directory)
if not abs_dir.endswith(os.sep): abs_dir += os.sep
return abs_file.startswith(abs_dir) or abs_file == abs_dir.rstrip(os.sep)

read_file/write_file/apply_diff/search_replace call this with the configured workspace (e.g. read_file.py: # Security check - ensure path is within workspace). Because abspath() does not canonicalize symlinks, a link at WORKSPACE/link_to_secret.txt → /outside/secret.txt has abspath WORKSPACE/link_to_secret.txt (inside) and passes, while open() follows it to the real outside target.

2. `list_files()` has no containment check (CWE-22)

# src/praisonai/praisonai/code/tools/list_files.py
if workspace and not os.path.isabs(path):
    abs_path = os.path.abspath(os.path.join(workspace, path))   # ../ collapses out of workspace
else:
    abs_path = os.path.abspath(path)                            # absolute path used as-is
# ... os.path.isdir(abs_path) then listed. is_path_within_directory() is NEVER called.

3. `execute_command()` never validates `cwd` (CWE-22)

# src/praisonai/praisonai/code/tools/execute_command.py — workspace param doc: "for security validation"
if cwd:
    if workspace and not os.path.isabs(cwd):
        work_dir = os.path.abspath(os.path.join(workspace, cwd))  # ../ escapes; no containment check
    else:
        work_dir = os.path.abspath(cwd)
# subprocess.run(args, cwd=work_dir, ...)   # no is_path_within_directory() anywhere

# src/praisonai/praisonai/code/agent_tools.py — code_execute_command()
if work_dir and _workspace_root and not os.path.isabs(work_dir):
    work_dir = os.path.join(_workspace_root, work_dir)   # joins, never validates
result = _execute_command(command=command, cwd=work_dir, timeout=120)  # workspace not even passed

Note: execute_command rejects shell=True and runs shlex.split(command) via subprocess.run (no shell), so shell metacharacters (&&, >, pipes) do not work — but any binary still runs with attacker-chosen argv from the escaped cwd, which is sufficient to read/write outside the workspace.

The workspace is an intended boundary (pre-empts "by design")

The module asserts this control itself: read_file.py "Security check - ensure path is within workspace"; write_file.py "default workspace is cwd so relative paths cannot escape"; is_path_within_directory docstring "(prevents path traversal)"; execute_command workspace param "for security validation". The bug is that the asserted control is unsound (abspath vs realpath) and not applied to list_files/execute_command cwd.

Proof of Concept

Self-contained, local temp fixtures only; no network, no untrusted commands. Real praisonai.code agent tools were called.

workspace = /tmp/.../workspace      outside = /tmp/.../outside
[1] baseline plain ../ read           -> BLOCKED: "Path '../outside/secret.txt' is outside the workspace"
[2] symlink read  (in-WS link)        -> SUCCESS: returned "SECRET_OUTSIDE_WORKSPACE"
[3] symlink write (in-WS link)        -> SUCCESS: outside file now contains "OVERWRITTEN_VIA_SYMLINK"
[4] code_list_files("../outside")     -> SUCCESS: "Contents of ../outside:  📄 secret.txt"
[5] code_execute_command(cwd="../outside","pwd") -> SUCCESS: stdout "/tmp/.../outside"
[6] code_execute_command(cwd="../outside", python3 -c open('planted.txt','w')...)
                                      -> SUCCESS: new file created OUTSIDE workspace, "PWNED_OUTSIDE_WORKSPACE"

Steps 2–6 each cross the configured workspace boundary; step 1 shows the plain-../ guard that the symlink and unscoped vectors bypass.

Impact

Confidentiality: read files outside the workspace (in-workspace symlink; or list/enumerate outside dirs via list_files).
Integrity: overwrite outside files via symlink; create/modify files outside the workspace via execute_command running in an escaped cwd.
Execution boundary: run arbitrary available binaries (argv-controlled) from a directory outside the workspace. Bounded by the process user's permissions. In a code-agent or server-exposed agent processing untrusted input, this exposes secrets / project-adjacent / host files and breaks the project-boundary integrity guarantee the workspace setting advertises.

Suggested Fix

Replace is_path_within_directory() with a realpath() / Path.resolve()-based containment check, and compare with os.path.commonpath() rather than startswith.
Apply that check consistently to every file path, directory path, backup path, diff/search-replace target, and command working directory, after full canonicalization (resolve the symlink's real target, not the link path).
list_files(): reject absolute paths and ../ escapes when workspace is set.
execute_command(): validate cwd containment when workspace is set; code_execute_command() should pass _workspace_root to the low-level helper or validate itself.
Regression tests: symlink read/write/diff/search-replace to outside targets; list_files("../outside", workspace=…); execute_command(cwd="../outside", workspace=…); absolute outside paths with a workspace set.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "PraisonAI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55540"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T14:54:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nPraisonAI\u0027s `praisonai.code` tool wrappers (exported as `CODE_TOOLS` for agents) expose a `workspace` setting that the module itself treats as a path-traversal **security boundary** \u2014 `read_file`, `write_file`, `apply_diff`, and `search_replace` explicitly call `is_path_within_directory()` and return `\"\u2026 is outside the workspace\"` on violations. That boundary is enforced **unsoundly and inconsistently**:\n \n1. The containment helper uses `os.path.abspath()`, not `realpath()`/`Path.resolve()`. A symlink located **inside** the workspace whose target is **outside** has an `abspath()` that is still inside the workspace, so it passes the check while `open()` follows the link. This bypasses read, write, apply_diff, and search_replace (CWE-59).\n2. `list_files()` resolves `path` against the workspace but **never** calls the containment helper at all \u2014 `../` and absolute paths escape directly (CWE-22).\n3. `execute_command()` takes a `workspace` argument documented \"for security validation\" but performs **no** `cwd` containment check; `code_execute_command()` resolves a relative `cwd` against the workspace and also never validates it (and never even passes `workspace` to the low-level helper). A relative `cwd=\"../outside\"` runs commands from outside the workspace (CWE-22).\nAn attacker who can influence an agent that has these tools attached (untrusted prompt, indirect prompt injection, or a server-exposed agent) can read, overwrite, list, and execute from outside the configured workspace, bounded only by the process user\u0027s filesystem permissions.\n\n## Technical Detail\n \n### 1. Unsound containment helper (symlink bypass \u2014 CWE-59)\n \n```python\n# src/praisonai/praisonai/code/utils/file_utils.py \u2014 is_path_within_directory()\nabs_file = os.path.abspath(file_path)     # does NOT resolve symlinks\nabs_dir  = os.path.abspath(directory)\nif not abs_dir.endswith(os.sep): abs_dir += os.sep\nreturn abs_file.startswith(abs_dir) or abs_file == abs_dir.rstrip(os.sep)\n```\n \n`read_file`/`write_file`/`apply_diff`/`search_replace` call this with the configured workspace (e.g. `read_file.py`: `# Security check - ensure path is within workspace`). Because `abspath()` does not canonicalize symlinks, a link at `WORKSPACE/link_to_secret.txt` \u2192 `/outside/secret.txt` has `abspath` `WORKSPACE/link_to_secret.txt` (inside) and passes, while `open()` follows it to the real outside target.\n \n### 2. `list_files()` has no containment check (CWE-22)\n \n```python\n# src/praisonai/praisonai/code/tools/list_files.py\nif workspace and not os.path.isabs(path):\n    abs_path = os.path.abspath(os.path.join(workspace, path))   # ../ collapses out of workspace\nelse:\n    abs_path = os.path.abspath(path)                            # absolute path used as-is\n# ... os.path.isdir(abs_path) then listed. is_path_within_directory() is NEVER called.\n```\n \n### 3. `execute_command()` never validates `cwd` (CWE-22)\n \n```python\n# src/praisonai/praisonai/code/tools/execute_command.py \u2014 workspace param doc: \"for security validation\"\nif cwd:\n    if workspace and not os.path.isabs(cwd):\n        work_dir = os.path.abspath(os.path.join(workspace, cwd))  # ../ escapes; no containment check\n    else:\n        work_dir = os.path.abspath(cwd)\n# subprocess.run(args, cwd=work_dir, ...)   # no is_path_within_directory() anywhere\n```\n \n```python\n# src/praisonai/praisonai/code/agent_tools.py \u2014 code_execute_command()\nif work_dir and _workspace_root and not os.path.isabs(work_dir):\n    work_dir = os.path.join(_workspace_root, work_dir)   # joins, never validates\nresult = _execute_command(command=command, cwd=work_dir, timeout=120)  # workspace not even passed\n```\n \nNote: `execute_command` rejects `shell=True` and runs `shlex.split(command)` via `subprocess.run` (no shell), so shell metacharacters (`\u0026\u0026`, `\u003e`, pipes) do not work \u2014 but any binary still runs with attacker-chosen argv **from the escaped cwd**, which is sufficient to read/write outside the workspace.\n \n### The workspace is an intended boundary (pre-empts \"by design\")\n \nThe module asserts this control itself: `read_file.py` \"Security check - ensure path is within workspace\"; `write_file.py` \"default workspace is cwd so relative paths cannot escape\"; `is_path_within_directory` docstring \"(prevents path traversal)\"; `execute_command` `workspace` param \"for security validation\". The bug is that the asserted control is unsound (abspath vs realpath) and not applied to `list_files`/`execute_command` cwd.\n\n## Proof of Concept\n \nSelf-contained, local temp fixtures only; no network, no untrusted commands. Real `praisonai.code` agent tools were called.\n \n```\nworkspace = /tmp/.../workspace      outside = /tmp/.../outside\n[1] baseline plain ../ read           -\u003e BLOCKED: \"Path \u0027../outside/secret.txt\u0027 is outside the workspace\"\n[2] symlink read  (in-WS link)        -\u003e SUCCESS: returned \"SECRET_OUTSIDE_WORKSPACE\"\n[3] symlink write (in-WS link)        -\u003e SUCCESS: outside file now contains \"OVERWRITTEN_VIA_SYMLINK\"\n[4] code_list_files(\"../outside\")     -\u003e SUCCESS: \"Contents of ../outside:  \ud83d\udcc4 secret.txt\"\n[5] code_execute_command(cwd=\"../outside\",\"pwd\") -\u003e SUCCESS: stdout \"/tmp/.../outside\"\n[6] code_execute_command(cwd=\"../outside\", python3 -c open(\u0027planted.txt\u0027,\u0027w\u0027)...)\n                                      -\u003e SUCCESS: new file created OUTSIDE workspace, \"PWNED_OUTSIDE_WORKSPACE\"\n```\n \nSteps 2\u20136 each cross the configured workspace boundary; step 1 shows the plain-`../` guard that the symlink and unscoped vectors bypass.\n \n## Impact\n \n- **Confidentiality**: read files outside the workspace (in-workspace symlink; or list/enumerate outside dirs via `list_files`).\n- **Integrity**: overwrite outside files via symlink; create/modify files outside the workspace via `execute_command` running in an escaped cwd.\n- **Execution boundary**: run arbitrary available binaries (argv-controlled) from a directory outside the workspace.\nBounded by the process user\u0027s permissions. In a code-agent or server-exposed agent processing untrusted input, this exposes secrets / project-adjacent / host files and breaks the project-boundary integrity guarantee the workspace setting advertises.\n\n## Suggested Fix\n \n- Replace `is_path_within_directory()` with a `realpath()` / `Path.resolve()`-based containment check, and compare with `os.path.commonpath()` rather than `startswith`.\n- Apply that check consistently to every file path, directory path, backup path, diff/search-replace target, **and command working directory**, after full canonicalization (resolve the symlink\u0027s real target, not the link path).\n- `list_files()`: reject absolute paths and `../` escapes when `workspace` is set.\n- `execute_command()`: validate `cwd` containment when `workspace` is set; `code_execute_command()` should pass `_workspace_root` to the low-level helper or validate itself.\n- Regression tests: symlink read/write/diff/search-replace to outside targets; `list_files(\"../outside\", workspace=\u2026)`; `execute_command(cwd=\"../outside\", workspace=\u2026)`; absolute outside paths with a workspace set.",
  "id": "GHSA-ch89-h4r2-c8f8",
  "modified": "2026-08-25T14:54:56Z",
  "published": "2026-08-25T14:54:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks"
}

PYSEC-2026-3888

Vulnerability from pysec - Published: 2026-09-10 09:44 - Updated: 2026-09-10 11:02

Details

Summary

The containment helper uses os.path.abspath(), not realpath()/Path.resolve(). A symlink located inside the workspace whose target is outside has an abspath() that is still inside the workspace, so it passes the check while open() follows the link. This bypasses read, write, apply_diff, and search_replace (CWE-59).
list_files() resolves path against the workspace but never calls the containment helper at all — ../ and absolute paths escape directly (CWE-22).
execute_command() takes a workspace argument documented "for security validation" but performs no cwd containment check; code_execute_command() resolves a relative cwd against the workspace and also never validates it (and never even passes workspace to the low-level helper). A relative cwd="../outside" runs commands from outside the workspace (CWE-22). An attacker who can influence an agent that has these tools attached (untrusted prompt, indirect prompt injection, or a server-exposed agent) can read, overwrite, list, and execute from outside the configured workspace, bounded only by the process user's filesystem permissions.

Technical Detail

1. Unsound containment helper (symlink bypass — CWE-59)

# src/praisonai/praisonai/code/utils/file_utils.py — is_path_within_directory()
abs_file = os.path.abspath(file_path)     # does NOT resolve symlinks
abs_dir  = os.path.abspath(directory)
if not abs_dir.endswith(os.sep): abs_dir += os.sep
return abs_file.startswith(abs_dir) or abs_file == abs_dir.rstrip(os.sep)

2. `list_files()` has no containment check (CWE-22)

# src/praisonai/praisonai/code/tools/list_files.py
if workspace and not os.path.isabs(path):
    abs_path = os.path.abspath(os.path.join(workspace, path))   # ../ collapses out of workspace
else:
    abs_path = os.path.abspath(path)                            # absolute path used as-is
# ... os.path.isdir(abs_path) then listed. is_path_within_directory() is NEVER called.

3. `execute_command()` never validates `cwd` (CWE-22)

# src/praisonai/praisonai/code/tools/execute_command.py — workspace param doc: "for security validation"
if cwd:
    if workspace and not os.path.isabs(cwd):
        work_dir = os.path.abspath(os.path.join(workspace, cwd))  # ../ escapes; no containment check
    else:
        work_dir = os.path.abspath(cwd)
# subprocess.run(args, cwd=work_dir, ...)   # no is_path_within_directory() anywhere

# src/praisonai/praisonai/code/agent_tools.py — code_execute_command()
if work_dir and _workspace_root and not os.path.isabs(work_dir):
    work_dir = os.path.join(_workspace_root, work_dir)   # joins, never validates
result = _execute_command(command=command, cwd=work_dir, timeout=120)  # workspace not even passed

The workspace is an intended boundary (pre-empts "by design")

Proof of Concept

Self-contained, local temp fixtures only; no network, no untrusted commands. Real praisonai.code agent tools were called.

workspace = /tmp/.../workspace      outside = /tmp/.../outside
[1] baseline plain ../ read           -> BLOCKED: "Path '../outside/secret.txt' is outside the workspace"
[2] symlink read  (in-WS link)        -> SUCCESS: returned "SECRET_OUTSIDE_WORKSPACE"
[3] symlink write (in-WS link)        -> SUCCESS: outside file now contains "OVERWRITTEN_VIA_SYMLINK"
[4] code_list_files("../outside")     -> SUCCESS: "Contents of ../outside:  📄 secret.txt"
[5] code_execute_command(cwd="../outside","pwd") -> SUCCESS: stdout "/tmp/.../outside"
[6] code_execute_command(cwd="../outside", python3 -c open('planted.txt','w')...)
                                      -> SUCCESS: new file created OUTSIDE workspace, "PWNED_OUTSIDE_WORKSPACE"

Steps 2–6 each cross the configured workspace boundary; step 1 shows the plain-../ guard that the symlink and unscoped vectors bypass.

Impact

Confidentiality: read files outside the workspace (in-workspace symlink; or list/enumerate outside dirs via list_files).
Integrity: overwrite outside files via symlink; create/modify files outside the workspace via execute_command running in an escaped cwd.
Execution boundary: run arbitrary available binaries (argv-controlled) from a directory outside the workspace. Bounded by the process user's permissions. In a code-agent or server-exposed agent processing untrusted input, this exposes secrets / project-adjacent / host files and breaks the project-boundary integrity guarantee the workspace setting advertises.

Suggested Fix

Replace is_path_within_directory() with a realpath() / Path.resolve()-based containment check, and compare with os.path.commonpath() rather than startswith.
Apply that check consistently to every file path, directory path, backup path, diff/search-replace target, and command working directory, after full canonicalization (resolve the symlink's real target, not the link path).
list_files(): reject absolute paths and ../ escapes when workspace is set.
execute_command(): validate cwd containment when workspace is set; code_execute_command() should pass _workspace_root to the low-level helper or validate itself.
Regression tests: symlink read/write/diff/search-replace to outside targets; list_files("../outside", workspace=…); execute_command(cwd="../outside", workspace=…); absolute outside paths with a workspace set.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Impacted products

Name	purl
praisonai	pkg:pypi/praisonai

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai",
        "purl": "pkg:pypi/praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.10",
        "0.0.11",
        "0.0.12",
        "0.0.13",
        "0.0.14",
        "0.0.15",
        "0.0.16",
        "0.0.17",
        "0.0.18",
        "0.0.19",
        "0.0.2",
        "0.0.20",
        "0.0.21",
        "0.0.22",
        "0.0.23",
        "0.0.24",
        "0.0.25",
        "0.0.26",
        "0.0.27",
        "0.0.28",
        "0.0.29",
        "0.0.3",
        "0.0.30",
        "0.0.31",
        "0.0.32",
        "0.0.33",
        "0.0.34",
        "0.0.35",
        "0.0.36",
        "0.0.37",
        "0.0.38",
        "0.0.39",
        "0.0.4",
        "0.0.40",
        "0.0.41",
        "0.0.42",
        "0.0.43",
        "0.0.44",
        "0.0.45",
        "0.0.46",
        "0.0.47",
        "0.0.48",
        "0.0.49",
        "0.0.5",
        "0.0.50",
        "0.0.52",
        "0.0.53",
        "0.0.54",
        "0.0.55",
        "0.0.56",
        "0.0.57",
        "0.0.58",
        "0.0.59",
        "0.0.59rc11",
        "0.0.59rc2",
        "0.0.59rc3",
        "0.0.59rc5",
        "0.0.59rc6",
        "0.0.59rc7",
        "0.0.59rc8",
        "0.0.59rc9",
        "0.0.6",
        "0.0.61",
        "0.0.64",
        "0.0.65",
        "0.0.66",
        "0.0.67",
        "0.0.68",
        "0.0.69",
        "0.0.7",
        "0.0.70",
        "0.0.71",
        "0.0.72",
        "0.0.73",
        "0.0.74",
        "0.0.8",
        "0.0.9",
        "0.1.0",
        "0.1.1",
        "0.1.10",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.1.9",
        "1.0.0",
        "1.0.1",
        "1.0.10",
        "1.0.11",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.0.8",
        "1.0.9",
        "2.0.0",
        "2.0.1",
        "2.0.10",
        "2.0.11",
        "2.0.12",
        "2.0.13",
        "2.0.14",
        "2.0.15",
        "2.0.16",
        "2.0.17",
        "2.0.18",
        "2.0.19",
        "2.0.2",
        "2.0.20",
        "2.0.22",
        "2.0.23",
        "2.0.24",
        "2.0.25",
        "2.0.26",
        "2.0.27",
        "2.0.28",
        "2.0.29",
        "2.0.3",
        "2.0.30",
        "2.0.31",
        "2.0.32",
        "2.0.33",
        "2.0.34",
        "2.0.35",
        "2.0.36",
        "2.0.37",
        "2.0.38",
        "2.0.39",
        "2.0.40",
        "2.0.41",
        "2.0.42",
        "2.0.43",
        "2.0.44",
        "2.0.45",
        "2.0.46",
        "2.0.47",
        "2.0.48",
        "2.0.49",
        "2.0.5",
        "2.0.50",
        "2.0.51",
        "2.0.53",
        "2.0.54",
        "2.0.55",
        "2.0.56",
        "2.0.57",
        "2.0.58",
        "2.0.59",
        "2.0.6",
        "2.0.60",
        "2.0.61",
        "2.0.62",
        "2.0.63",
        "2.0.64",
        "2.0.65",
        "2.0.66",
        "2.0.67",
        "2.0.68",
        "2.0.69",
        "2.0.7",
        "2.0.70",
        "2.0.71",
        "2.0.72",
        "2.0.73",
        "2.0.74",
        "2.0.75",
        "2.0.76",
        "2.0.77",
        "2.0.78",
        "2.0.79",
        "2.0.8",
        "2.0.80",
        "2.0.81",
        "2.0.9",
        "2.1.0",
        "2.1.1",
        "2.1.4",
        "2.1.5",
        "2.1.6",
        "2.2.1",
        "2.2.10",
        "2.2.11",
        "2.2.12",
        "2.2.13",
        "2.2.14",
        "2.2.15",
        "2.2.16",
        "2.2.17",
        "2.2.18",
        "2.2.19",
        "2.2.2",
        "2.2.20",
        "2.2.21",
        "2.2.22",
        "2.2.24",
        "2.2.25",
        "2.2.26",
        "2.2.27",
        "2.2.28",
        "2.2.29",
        "2.2.3",
        "2.2.30",
        "2.2.31",
        "2.2.32",
        "2.2.33",
        "2.2.34",
        "2.2.35",
        "2.2.36",
        "2.2.37",
        "2.2.38",
        "2.2.39",
        "2.2.4",
        "2.2.40",
        "2.2.41",
        "2.2.42",
        "2.2.43",
        "2.2.44",
        "2.2.45",
        "2.2.46",
        "2.2.47",
        "2.2.48",
        "2.2.49",
        "2.2.5",
        "2.2.50",
        "2.2.51",
        "2.2.52",
        "2.2.53",
        "2.2.54",
        "2.2.55",
        "2.2.56",
        "2.2.57",
        "2.2.58",
        "2.2.59",
        "2.2.6",
        "2.2.60",
        "2.2.61",
        "2.2.62",
        "2.2.63",
        "2.2.64",
        "2.2.65",
        "2.2.66",
        "2.2.67",
        "2.2.68",
        "2.2.69",
        "2.2.7",
        "2.2.70",
        "2.2.71",
        "2.2.72",
        "2.2.73",
        "2.2.74",
        "2.2.75",
        "2.2.76",
        "2.2.77",
        "2.2.78",
        "2.2.79",
        "2.2.8",
        "2.2.80",
        "2.2.81",
        "2.2.82",
        "2.2.83",
        "2.2.84",
        "2.2.86",
        "2.2.87",
        "2.2.88",
        "2.2.89",
        "2.2.9",
        "2.2.90",
        "2.2.91",
        "2.2.93",
        "2.2.95",
        "2.2.96",
        "2.2.97",
        "2.2.98",
        "2.2.99",
        "2.3.0",
        "2.3.1",
        "2.3.10",
        "2.3.11",
        "2.3.12",
        "2.3.13",
        "2.3.14",
        "2.3.15",
        "2.3.16",
        "2.3.18",
        "2.3.19",
        "2.3.2",
        "2.3.20",
        "2.3.21",
        "2.3.22",
        "2.3.23",
        "2.3.24",
        "2.3.25",
        "2.3.26",
        "2.3.27",
        "2.3.28",
        "2.3.29",
        "2.3.3",
        "2.3.30",
        "2.3.31",
        "2.3.32",
        "2.3.33",
        "2.3.34",
        "2.3.35",
        "2.3.36",
        "2.3.37",
        "2.3.38",
        "2.3.39",
        "2.3.4",
        "2.3.40",
        "2.3.41",
        "2.3.42",
        "2.3.43",
        "2.3.44",
        "2.3.45",
        "2.3.46",
        "2.3.47",
        "2.3.48",
        "2.3.49",
        "2.3.5",
        "2.3.50",
        "2.3.51",
        "2.3.52",
        "2.3.53",
        "2.3.54",
        "2.3.55",
        "2.3.56",
        "2.3.57",
        "2.3.58",
        "2.3.59",
        "2.3.6",
        "2.3.60",
        "2.3.61",
        "2.3.62",
        "2.3.63",
        "2.3.64",
        "2.3.65",
        "2.3.66",
        "2.3.67",
        "2.3.68",
        "2.3.69",
        "2.3.7",
        "2.3.70",
        "2.3.71",
        "2.3.72",
        "2.3.73",
        "2.3.74",
        "2.3.75",
        "2.3.76",
        "2.3.77",
        "2.3.78",
        "2.3.79",
        "2.3.8",
        "2.3.80",
        "2.3.81",
        "2.3.82",
        "2.3.83",
        "2.3.84",
        "2.3.85",
        "2.3.86",
        "2.3.87",
        "2.3.9",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "2.4.4",
        "2.5.0",
        "2.5.1",
        "2.5.2",
        "2.5.3",
        "2.5.4",
        "2.5.5",
        "2.5.6",
        "2.5.7",
        "2.6.0",
        "2.6.1",
        "2.6.2",
        "2.6.3",
        "2.6.4",
        "2.6.5",
        "2.6.6",
        "2.6.7",
        "2.6.8",
        "2.7.0",
        "2.8.3",
        "2.8.4",
        "2.8.5",
        "2.8.6",
        "2.8.7",
        "2.8.8",
        "2.8.9",
        "2.9.0",
        "2.9.1",
        "2.9.2",
        "3.0.0",
        "3.0.1",
        "3.0.2",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.0.6",
        "3.0.7",
        "3.0.8",
        "3.0.9",
        "3.1.0",
        "3.1.1",
        "3.1.2",
        "3.1.3",
        "3.1.4",
        "3.1.5",
        "3.1.6",
        "3.1.7",
        "3.1.8",
        "3.1.9",
        "3.10.0",
        "3.10.1",
        "3.10.10",
        "3.10.11",
        "3.10.12",
        "3.10.13",
        "3.10.14",
        "3.10.15",
        "3.10.16",
        "3.10.17",
        "3.10.18",
        "3.10.19",
        "3.10.2",
        "3.10.20",
        "3.10.21",
        "3.10.22",
        "3.10.23",
        "3.10.24",
        "3.10.25",
        "3.10.26",
        "3.10.27",
        "3.10.3",
        "3.10.4",
        "3.10.5",
        "3.10.6",
        "3.10.7",
        "3.10.8",
        "3.10.9",
        "3.11.0",
        "3.11.1",
        "3.11.10",
        "3.11.11",
        "3.11.12",
        "3.11.13",
        "3.11.14",
        "3.11.2",
        "3.11.3",
        "3.11.4",
        "3.11.8",
        "3.11.9",
        "3.12.0",
        "3.12.1",
        "3.12.2",
        "3.12.3",
        "3.2.0",
        "3.2.1",
        "3.3.0",
        "3.3.1",
        "3.4.0",
        "3.4.1",
        "3.5.0",
        "3.5.1",
        "3.5.2",
        "3.5.3",
        "3.5.4",
        "3.5.5",
        "3.5.6",
        "3.5.7",
        "3.5.8",
        "3.5.9",
        "3.6.0",
        "3.6.1",
        "3.6.2",
        "3.7.0",
        "3.7.1",
        "3.7.2",
        "3.7.3",
        "3.7.4",
        "3.7.5",
        "3.7.6",
        "3.7.7",
        "3.7.8",
        "3.7.9",
        "3.8.0",
        "3.8.1",
        "3.8.10",
        "3.8.11",
        "3.8.12",
        "3.8.13",
        "3.8.14",
        "3.8.16",
        "3.8.17",
        "3.8.18",
        "3.8.19",
        "3.8.2",
        "3.8.20",
        "3.8.21",
        "3.8.22",
        "3.8.3",
        "3.8.4",
        "3.8.5",
        "3.8.6",
        "3.8.7",
        "3.8.8",
        "3.8.9",
        "3.9.0",
        "3.9.1",
        "3.9.10",
        "3.9.11",
        "3.9.12",
        "3.9.13",
        "3.9.14",
        "3.9.15",
        "3.9.16",
        "3.9.17",
        "3.9.18",
        "3.9.19",
        "3.9.2",
        "3.9.20",
        "3.9.21",
        "3.9.22",
        "3.9.23",
        "3.9.24",
        "3.9.25",
        "3.9.26",
        "3.9.27",
        "3.9.28",
        "3.9.29",
        "3.9.3",
        "3.9.30",
        "3.9.31",
        "3.9.32",
        "3.9.33",
        "3.9.34",
        "3.9.35",
        "3.9.4",
        "3.9.5",
        "3.9.6",
        "3.9.7",
        "3.9.8",
        "3.9.9",
        "4.0.0",
        "4.1.0",
        "4.2.0",
        "4.2.1",
        "4.2.2",
        "4.2.3",
        "4.2.4",
        "4.3.0",
        "4.3.1",
        "4.4.0",
        "4.4.10",
        "4.4.11",
        "4.4.12",
        "4.4.2",
        "4.4.3",
        "4.4.4",
        "4.4.5",
        "4.4.6",
        "4.4.7",
        "4.4.8",
        "4.4.9",
        "4.5.0",
        "4.5.1",
        "4.5.10",
        "4.5.100",
        "4.5.101",
        "4.5.102",
        "4.5.103",
        "4.5.104",
        "4.5.105",
        "4.5.106",
        "4.5.107",
        "4.5.108",
        "4.5.109",
        "4.5.11",
        "4.5.110",
        "4.5.111",
        "4.5.112",
        "4.5.113",
        "4.5.114",
        "4.5.115",
        "4.5.117",
        "4.5.118",
        "4.5.119",
        "4.5.12",
        "4.5.120",
        "4.5.121",
        "4.5.122",
        "4.5.123",
        "4.5.124",
        "4.5.125",
        "4.5.126",
        "4.5.127",
        "4.5.128",
        "4.5.129",
        "4.5.13",
        "4.5.130",
        "4.5.131",
        "4.5.132",
        "4.5.133",
        "4.5.134",
        "4.5.135",
        "4.5.136",
        "4.5.137",
        "4.5.139",
        "4.5.14",
        "4.5.140",
        "4.5.143",
        "4.5.144",
        "4.5.145",
        "4.5.149",
        "4.5.15",
        "4.5.16",
        "4.5.18",
        "4.5.19",
        "4.5.2",
        "4.5.20",
        "4.5.21",
        "4.5.22",
        "4.5.23",
        "4.5.24",
        "4.5.25",
        "4.5.26",
        "4.5.27",
        "4.5.28",
        "4.5.29",
        "4.5.3",
        "4.5.30",
        "4.5.31",
        "4.5.32",
        "4.5.33",
        "4.5.34",
        "4.5.35",
        "4.5.36",
        "4.5.37",
        "4.5.38",
        "4.5.39",
        "4.5.40",
        "4.5.41",
        "4.5.42",
        "4.5.43",
        "4.5.44",
        "4.5.45",
        "4.5.46",
        "4.5.48",
        "4.5.49",
        "4.5.5",
        "4.5.51",
        "4.5.52",
        "4.5.54",
        "4.5.55",
        "4.5.56",
        "4.5.57",
        "4.5.58",
        "4.5.59",
        "4.5.6",
        "4.5.60",
        "4.5.62",
        "4.5.63",
        "4.5.64",
        "4.5.65",
        "4.5.67",
        "4.5.68",
        "4.5.69",
        "4.5.7",
        "4.5.70",
        "4.5.71",
        "4.5.72",
        "4.5.73",
        "4.5.74",
        "4.5.76",
        "4.5.77",
        "4.5.78",
        "4.5.79",
        "4.5.8",
        "4.5.80",
        "4.5.81",
        "4.5.82",
        "4.5.83",
        "4.5.85",
        "4.5.87",
        "4.5.88",
        "4.5.89",
        "4.5.9",
        "4.5.90",
        "4.5.93",
        "4.5.94",
        "4.5.95",
        "4.5.96",
        "4.5.97",
        "4.5.98",
        "4.6.10",
        "4.6.11",
        "4.6.12",
        "4.6.13",
        "4.6.14",
        "4.6.15",
        "4.6.16",
        "4.6.18",
        "4.6.19",
        "4.6.20",
        "4.6.21",
        "4.6.22",
        "4.6.23",
        "4.6.24",
        "4.6.25",
        "4.6.26",
        "4.6.27",
        "4.6.28",
        "4.6.29",
        "4.6.30",
        "4.6.31",
        "4.6.32",
        "4.6.33",
        "4.6.34",
        "4.6.35",
        "4.6.36",
        "4.6.37",
        "4.6.38",
        "4.6.39",
        "4.6.40",
        "4.6.41",
        "4.6.42",
        "4.6.43",
        "4.6.44",
        "4.6.45",
        "4.6.46",
        "4.6.47",
        "4.6.48",
        "4.6.50",
        "4.6.51",
        "4.6.52",
        "4.6.53",
        "4.6.54",
        "4.6.55",
        "4.6.56",
        "4.6.57",
        "4.6.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55540",
    "GHSA-ch89-h4r2-c8f8"
  ],
  "details": "### Summary\nPraisonAI\u0027s `praisonai.code` tool wrappers (exported as `CODE_TOOLS` for agents) expose a `workspace` setting that the module itself treats as a path-traversal **security boundary** \u2014 `read_file`, `write_file`, `apply_diff`, and `search_replace` explicitly call `is_path_within_directory()` and return `\"\u2026 is outside the workspace\"` on violations. That boundary is enforced **unsoundly and inconsistently**:\n \n1. The containment helper uses `os.path.abspath()`, not `realpath()`/`Path.resolve()`. A symlink located **inside** the workspace whose target is **outside** has an `abspath()` that is still inside the workspace, so it passes the check while `open()` follows the link. This bypasses read, write, apply_diff, and search_replace (CWE-59).\n2. `list_files()` resolves `path` against the workspace but **never** calls the containment helper at all \u2014 `../` and absolute paths escape directly (CWE-22).\n3. `execute_command()` takes a `workspace` argument documented \"for security validation\" but performs **no** `cwd` containment check; `code_execute_command()` resolves a relative `cwd` against the workspace and also never validates it (and never even passes `workspace` to the low-level helper). A relative `cwd=\"../outside\"` runs commands from outside the workspace (CWE-22).\nAn attacker who can influence an agent that has these tools attached (untrusted prompt, indirect prompt injection, or a server-exposed agent) can read, overwrite, list, and execute from outside the configured workspace, bounded only by the process user\u0027s filesystem permissions.\n\n## Technical Detail\n \n### 1. Unsound containment helper (symlink bypass \u2014 CWE-59)\n \n```python\n# src/praisonai/praisonai/code/utils/file_utils.py \u2014 is_path_within_directory()\nabs_file = os.path.abspath(file_path)     # does NOT resolve symlinks\nabs_dir  = os.path.abspath(directory)\nif not abs_dir.endswith(os.sep): abs_dir += os.sep\nreturn abs_file.startswith(abs_dir) or abs_file == abs_dir.rstrip(os.sep)\n```\n \n`read_file`/`write_file`/`apply_diff`/`search_replace` call this with the configured workspace (e.g. `read_file.py`: `# Security check - ensure path is within workspace`). Because `abspath()` does not canonicalize symlinks, a link at `WORKSPACE/link_to_secret.txt` \u2192 `/outside/secret.txt` has `abspath` `WORKSPACE/link_to_secret.txt` (inside) and passes, while `open()` follows it to the real outside target.\n \n### 2. `list_files()` has no containment check (CWE-22)\n \n```python\n# src/praisonai/praisonai/code/tools/list_files.py\nif workspace and not os.path.isabs(path):\n    abs_path = os.path.abspath(os.path.join(workspace, path))   # ../ collapses out of workspace\nelse:\n    abs_path = os.path.abspath(path)                            # absolute path used as-is\n# ... os.path.isdir(abs_path) then listed. is_path_within_directory() is NEVER called.\n```\n \n### 3. `execute_command()` never validates `cwd` (CWE-22)\n \n```python\n# src/praisonai/praisonai/code/tools/execute_command.py \u2014 workspace param doc: \"for security validation\"\nif cwd:\n    if workspace and not os.path.isabs(cwd):\n        work_dir = os.path.abspath(os.path.join(workspace, cwd))  # ../ escapes; no containment check\n    else:\n        work_dir = os.path.abspath(cwd)\n# subprocess.run(args, cwd=work_dir, ...)   # no is_path_within_directory() anywhere\n```\n \n```python\n# src/praisonai/praisonai/code/agent_tools.py \u2014 code_execute_command()\nif work_dir and _workspace_root and not os.path.isabs(work_dir):\n    work_dir = os.path.join(_workspace_root, work_dir)   # joins, never validates\nresult = _execute_command(command=command, cwd=work_dir, timeout=120)  # workspace not even passed\n```\n \nNote: `execute_command` rejects `shell=True` and runs `shlex.split(command)` via `subprocess.run` (no shell), so shell metacharacters (`\u0026\u0026`, `\u003e`, pipes) do not work \u2014 but any binary still runs with attacker-chosen argv **from the escaped cwd**, which is sufficient to read/write outside the workspace.\n \n### The workspace is an intended boundary (pre-empts \"by design\")\n \nThe module asserts this control itself: `read_file.py` \"Security check - ensure path is within workspace\"; `write_file.py` \"default workspace is cwd so relative paths cannot escape\"; `is_path_within_directory` docstring \"(prevents path traversal)\"; `execute_command` `workspace` param \"for security validation\". The bug is that the asserted control is unsound (abspath vs realpath) and not applied to `list_files`/`execute_command` cwd.\n\n## Proof of Concept\n \nSelf-contained, local temp fixtures only; no network, no untrusted commands. Real `praisonai.code` agent tools were called.\n \n```\nworkspace = /tmp/.../workspace      outside = /tmp/.../outside\n[1] baseline plain ../ read           -\u003e BLOCKED: \"Path \u0027../outside/secret.txt\u0027 is outside the workspace\"\n[2] symlink read  (in-WS link)        -\u003e SUCCESS: returned \"SECRET_OUTSIDE_WORKSPACE\"\n[3] symlink write (in-WS link)        -\u003e SUCCESS: outside file now contains \"OVERWRITTEN_VIA_SYMLINK\"\n[4] code_list_files(\"../outside\")     -\u003e SUCCESS: \"Contents of ../outside:  \ud83d\udcc4 secret.txt\"\n[5] code_execute_command(cwd=\"../outside\",\"pwd\") -\u003e SUCCESS: stdout \"/tmp/.../outside\"\n[6] code_execute_command(cwd=\"../outside\", python3 -c open(\u0027planted.txt\u0027,\u0027w\u0027)...)\n                                      -\u003e SUCCESS: new file created OUTSIDE workspace, \"PWNED_OUTSIDE_WORKSPACE\"\n```\n \nSteps 2\u20136 each cross the configured workspace boundary; step 1 shows the plain-`../` guard that the symlink and unscoped vectors bypass.\n \n## Impact\n \n- **Confidentiality**: read files outside the workspace (in-workspace symlink; or list/enumerate outside dirs via `list_files`).\n- **Integrity**: overwrite outside files via symlink; create/modify files outside the workspace via `execute_command` running in an escaped cwd.\n- **Execution boundary**: run arbitrary available binaries (argv-controlled) from a directory outside the workspace.\nBounded by the process user\u0027s permissions. In a code-agent or server-exposed agent processing untrusted input, this exposes secrets / project-adjacent / host files and breaks the project-boundary integrity guarantee the workspace setting advertises.\n\n## Suggested Fix\n \n- Replace `is_path_within_directory()` with a `realpath()` / `Path.resolve()`-based containment check, and compare with `os.path.commonpath()` rather than `startswith`.\n- Apply that check consistently to every file path, directory path, backup path, diff/search-replace target, **and command working directory**, after full canonicalization (resolve the symlink\u0027s real target, not the link path).\n- `list_files()`: reject absolute paths and `../` escapes when `workspace` is set.\n- `execute_command()`: validate `cwd` containment when `workspace` is set; `code_execute_command()` should pass `_workspace_root` to the low-level helper or validate itself.\n- Regression tests: symlink read/write/diff/search-replace to outside targets; `list_files(\"../outside\", workspace=\u2026)`; `execute_command(cwd=\"../outside\", workspace=\u2026)`; absolute outside paths with a workspace set.",
  "id": "PYSEC-2026-3888",
  "modified": "2026-09-10T11:02:26.665293Z",
  "published": "2026-09-10T09:44:54.553908Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/praisonai"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-ch89-h4r2-c8f8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55540"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55540 (GCVE-0-2026-55540)

FKIE_CVE-2026-55540

GHSA-CH89-H4R2-C8F8

Summary

Technical Detail

1. Unsound containment helper (symlink bypass — CWE-59)

2. list_files() has no containment check (CWE-22)

3. execute_command() never validates cwd (CWE-22)

The workspace is an intended boundary (pre-empts "by design")

Proof of Concept

Impact

Suggested Fix

PYSEC-2026-3888

Summary

Technical Detail

1. Unsound containment helper (symlink bypass — CWE-59)

2. list_files() has no containment check (CWE-22)

3. execute_command() never validates cwd (CWE-22)

The workspace is an intended boundary (pre-empts "by design")

Proof of Concept

Impact

Suggested Fix

Tags

Sightings

Nomenclature

Related by attack behaviour

2. `list_files()` has no containment check (CWE-22)

3. `execute_command()` never validates `cwd` (CWE-22)

2. `list_files()` has no containment check (CWE-22)

3. `execute_command()` never validates `cwd` (CWE-22)