by Kastro
Paper/Archive/CVE-2026-57145

CVE-2026-57145

MervinPraison PraisonAI — PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 45.7.457 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read files through edit and diff behavior or overwrite files accessible to the process, exposing secrets and enabling persistence or application tampering. This issue is fixed in 4.6.62.

Affected

ProductAffectedFixed inSource
PraisonAI< 4.6.62–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/MervinPraison/PraisonAI/security/advisories/GHSA-29w3-p9w9-wc47refgithub.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33refgithub.com/MervinPraison/PraisonAI/releases/tag/v4.6.62