CVE-2026-57145

Published: Sep 14, 2026Modified: Sep 15, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read files through edit and diff behavior or overwrite files accessible to the process, exposing secrets and enabling persistence or application tampering. This issue is fixed in 4.6.62.

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33

Source: security-advisories@github.com

https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62

Source: security-advisories@github.com

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29w3-p9w9-wc47

Source: security-advisories@github.com

Timeline

No history available yet.