CVE-2026-56839: PraisonAI Path Traversal Vulnerability

CVE-2026-56839 Overview

PraisonAI, a multi-agent teams framework maintained by MervinPraison, contains a path traversal vulnerability [CWE-22] in its CODE_TOOLS wrappers. Versions prior to 4.6.59 initialize _workspace_root as None and pass workspace=None to the read_file, search_replace, and apply_diff helpers. These helpers only enforce path containment when a truthy workspace value is present. Applications that expose code_read_file, code_search_replace, or code_apply_diff before calling set_workspace allow prompt-influenced agent calls to read and modify files outside the intended project directory. The maintainer released a fix in version 4.6.59.

Critical Impact
Prompt injection or adversarial agent input can escape the intended workspace, enabling arbitrary file read and write across the host filesystem accessible to the PraisonAI process.

Affected Products

PraisonAI versions prior to 4.6.59
Applications exposing code_read_file, code_search_replace, or code_apply_diff before set_workspace is invoked
Multi-agent deployments using the default CODE_TOOLS wrappers

Discovery Timeline

2026-09-14 - CVE-2026-56839 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-56839

Vulnerability Analysis

The defect resides in the CODE_TOOLS wrappers of PraisonAI. Each wrapper delegates to lower-level helpers (read_file, search_replace, apply_diff) that accept a workspace argument used to constrain filesystem operations to a project root. Path containment logic is guarded by a truthy check on workspace. When the wrapper passes workspace=None, the check is skipped and no containment is enforced.

Because PraisonAI orchestrates LLM-driven agents, file path arguments to these tools are typically derived from model output. An attacker who controls or influences prompts can request paths like ../../etc/passwd or absolute paths outside the project directory. This turns a code-assistance tool into an arbitrary file read/write primitive.

Root Cause

The _workspace_root attribute in the tool wrappers is initialized to None and is only populated when a caller explicitly invokes set_workspace. The helper functions treat a falsy workspace as "no restriction requested" instead of "deny by default," inverting the safe posture expected for filesystem sandboxing.

Attack Vector

Exploitation requires the vulnerable tools to be exposed to an agent before set_workspace is called, and requires user interaction to submit a prompt that reaches the affected agent. A crafted prompt instructs the agent to read or modify files using paths outside the intended directory. Successful exploitation yields disclosure of sensitive files and integrity loss on project or system files writable by the PraisonAI process.

No functional exploit code is published in the referenced advisory. Refer to the GitHub Security Advisory GHSA-gcq3-mfvh-3x25 and the fix commit for the corrected containment logic.

Detection Methods for CVE-2026-56839

Indicators of Compromise

Filesystem access by the PraisonAI process to paths outside the declared project workspace, especially /etc, user home directories, or cloud credential paths.
Agent tool invocation logs containing .. sequences, absolute paths, or symbolic link targets in arguments to code_read_file, code_search_replace, or code_apply_diff.
Unexpected modifications to files under paths not owned by the agent project.

Detection Strategies

Audit PraisonAI application code for calls to set_workspace prior to any registration or exposure of the CODE_TOOLS helpers.
Instrument the read_file, search_replace, and apply_diff helpers to log the resolved absolute path for each call and compare against an allowlist.
Review LLM tool-call transcripts for path arguments that resolve outside the intended project root.

Monitoring Recommendations

Enable filesystem auditing (auditd, EDR file telemetry) on hosts running PraisonAI to capture read/write events by the interpreter process.
Alert on agent tool invocations where argument path traversal tokens (.., ~, absolute prefixes) appear in production traffic.
Track the installed PraisonAI package version across environments and flag any instance below 4.6.59.

How to Mitigate CVE-2026-56839

Immediate Actions Required

Upgrade PraisonAI to version 4.6.59 or later using pip install --upgrade praisonai.
Call set_workspace with an explicit project directory before exposing any CODE_TOOLS wrapper to agents.
Run the PraisonAI process under a least-privilege user account with filesystem access limited to the project tree.

Patch Information

The fix is delivered in PraisonAI release v4.6.59. The corresponding source change is available in the GitHub commit b4270173. Coordinated disclosure details are published in GitHub Security Advisory GHSA-gcq3-mfvh-3x25.

Workarounds

Explicitly configure a workspace with set_workspace(<project_path>) at application startup before registering any code tools; explicitly configured workspaces remain effective even on vulnerable versions.
Remove or disable code_read_file, code_search_replace, and code_apply_diff from the tool registry if a workspace cannot be set.
Confine the PraisonAI process with a container, chroot, or Linux namespace that limits reachable filesystem paths.

bash

# Configuration example: enforce workspace before exposing code tools
from praisonaiagents.tools import set_workspace, code_read_file, code_search_replace, code_apply_diff

# Set the workspace root BEFORE any agent gains access to CODE_TOOLS
set_workspace("/opt/praisonai/projects/current")

# Only then register the tools with the agent
tools = [code_read_file, code_search_replace, code_apply_diff]