CVE-2026-47397: PraisonAI Path Traversal Vulnerability

CVE-2026-47397 Overview

CVE-2026-47397 is a path traversal vulnerability [CWE-22] in PraisonAI, a multi-agent teams system maintained by MervinPraison. Prior to version 4.6.40, hidden metadata embedded in a webpage can coerce PraisonAI agents into writing attacker-controlled content to arbitrary filesystem paths. The write_file tool skips path validation when workspace=None, which is the default state in production deployments. An attacker who controls a URL that an agent fetches can therefore direct file writes outside any intended sandbox. Version 4.6.40 resolves the flaw by adding URL validation and hardening file handling routines.

Critical Impact
Remote, low-privilege attackers can leverage indirect prompt injection through webpage metadata to write attacker-controlled files to arbitrary paths on the host running a PraisonAI agent.

Affected Products

PraisonAI multi-agent teams system prior to version 4.6.40
praisonaiagents Python package (module praisonaiagents.tools)
Deployments using the write_file tool with default workspace=None

Discovery Timeline

2026-07-21 - CVE-2026-47397 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47397

Vulnerability Analysis

The vulnerability chains two weaknesses in the PraisonAI agent tool set. First, the URL fetching routine in mentions.py processes @url: mentions without validating whether the target URL is permitted. Second, the write_file tool skips path validation when the workspace argument is None, which is the default in production. An attacker hosts a webpage containing hidden metadata that instructs the agent to write specific content to specific paths. When an agent consumes the page, it interprets the hidden instructions and executes the write_file call unchecked. The impact is high on integrity because the attacker fully controls the destination path and file contents on the host running the agent.

Root Cause

The root cause is missing input validation in two locations. The _process_url_mention function in src/praisonai-agents/praisonaiagents/tools/mentions.py fetched arbitrary URLs without allow-list checks. The write_file function did not enforce a workspace boundary when none was configured, allowing paths outside any intended directory. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Attack Vector

An attacker publishes a webpage containing hidden metadata designed to prompt-inject an agent. A PraisonAI agent that fetches the URL, either autonomously or through an @url: mention, parses the hidden content and invokes write_file with an attacker-controlled path and payload. Because no workspace is enforced, the file lands anywhere the agent process can write, including startup directories, cron paths, or configuration files.

python

# Security patch in src/praisonai-agents/praisonaiagents/tools/mentions.py
 def _process_url_mention(self, url: str) -> Optional[str]:
     """Process @url:https://... mention."""
     try:
+        from praisonaiagents.tools.spider_tools import SpiderTools
+
+        if not SpiderTools()._validate_url(url):
+            return f"# URL: {url}\n[Blocked: URL is not allowed]"
+
         import urllib.request
         
         req = urllib.request.Request(
# Source: https://github.com/MervinPraison/PraisonAI/commit/b0d8f777528f3253a0cfb0a3ef65455da6ae32f6

The patch adds an explicit _validate_url check before any network fetch and imports ipaddress and socket in spider_tools.py to support SSRF-style network validation.

Detection Methods for CVE-2026-47397

Indicators of Compromise

Unexpected files created by the PraisonAI agent process outside its intended working directory
Agent log entries showing write_file calls with absolute paths or .. sequences
Outbound HTTP requests from agent hosts to previously unseen domains prior to file writes
Presence of praisonaiagents package versions earlier than 4.6.40 in production inventories

Detection Strategies

Instrument the agent runtime to log every write_file invocation, including caller, path, and content hash
Alert on file writes by the agent process that target paths outside a defined allow-list (for example /etc, /root, user home directories, systemd unit paths)
Correlate outbound URL fetches performed by the agent with subsequent filesystem writes within a short time window

Monitoring Recommendations

Track the installed version of the praisonaiagents package across all hosts and container images
Monitor process telemetry for the Python interpreter hosting PraisonAI, focusing on open() and write() syscalls to sensitive locations
Baseline the domains that agents are permitted to fetch and alert on deviations

How to Mitigate CVE-2026-47397

Immediate Actions Required

Upgrade the praisonaiagents package to version 4.6.40 or later across all environments
Audit agent hosts for files written since deployment to identify any that may have been placed by exploiting this issue
Restrict outbound network access from agent workloads to a curated allow-list of domains
Run agents as unprivileged users inside containers with read-only root filesystems where feasible

Patch Information

The fix is delivered in PraisonAI version 4.6.40 via GitHub Pull Request #1684 and merged in commit b0d8f777. See the GitHub Security Advisory GHSA-hvhp-v2gc-268q for the full disclosure.

Workarounds

Explicitly set a non-Noneworkspace parameter for every write_file invocation so path validation is enforced
Wrap the agent process in a mandatory access control profile (AppArmor or SELinux) that limits write destinations
Disable or gate the @url: mention handler in untrusted agent workflows until the upgrade is applied

bash

# Upgrade PraisonAI to the patched release
pip install --upgrade 'praisonaiagents>=4.6.40'

# Verify the installed version
python -c "import praisonaiagents, sys; print(praisonaiagents.__version__)"