CVE-2026-57129: PraisonAI Path Traversal Vulnerability

CVE-2026-57129 Overview

CVE-2026-57129 is a path traversal vulnerability [CWE-22] in PraisonAI, a multi-agent teams system built on the praisonaiagents Python package. Versions prior to 1.6.59 contain a flaw in MentionsParser._process_file_mention, which resolves file-mention values through Path(file_path) when workspace-relative resolution fails. The fallback lacks traversal, symlink, and workspace-boundary validation. Attackers who can influence prompt input, whether through users, bots, or automated workflows, can read arbitrary files accessible to the agent process. Affected files include credentials, private keys, .env environment files, application source code, and system configuration data.

Critical Impact

Unauthenticated prompt input can trigger arbitrary file reads across the host filesystem, exposing secrets used by AI agent deployments.

Affected Products

• praisonaiagents versions prior to 1.6.59
• PraisonAI multi-agent deployments consuming untrusted prompt input
• Downstream applications embedding the MentionsParser component

Discovery Timeline

• 2026-09-14 - CVE-2026-57129 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-57129

Vulnerability Analysis

The MentionsParser component parses @file style mentions from prompts to attach file contents to agent context. When a mention cannot be resolved relative to the configured workspace directory, the parser falls back to constructing a Path(file_path) object from the raw input. That path is then read directly without validating that the resolved location remains inside the workspace boundary. An attacker submitting a mention such as @/etc/passwd or @../../root/.ssh/id_rsa triggers a file read at the injected location. The parser also does not resolve or reject symbolic links, so a benign filename inside the workspace can redirect the read to a target outside it.

Root Cause

The root cause is missing input validation on file paths supplied through prompt mentions. The fallback resolution path in _process_file_mention trusts the caller-controlled string, omitting checks for .. sequences, absolute paths, and symlink targets. This maps directly to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires only the ability to submit prompt content to a PraisonAI agent. This includes chat interfaces, webhook-driven bots, scheduled workflows, and inter-agent messaging channels. No authentication or user interaction is required beyond delivering the crafted mention to the agent. Any file readable by the process user is exposed, which in typical container or service deployments includes API keys, cloud credentials, and application source.

The upstream patch is available in the GitHub Commit Update and the accompanying GitHub Security Advisory GHSA-2rcg-mm5h-xchx. No public proof-of-concept exploit code has been released.

Detection Methods for CVE-2026-57129

Indicators of Compromise

• Prompt logs containing file mentions with absolute paths such as @/etc/, @/root/, or @/proc/
• Prompt mentions containing directory traversal sequences like @../ or URL-encoded variants
• Agent process reads of sensitive files (/etc/passwd, .env, ~/.aws/credentials, id_rsa) outside the configured workspace
• Unexpected outbound transmission of file contents in agent responses or tool call payloads

Detection Strategies

• Instrument MentionsParser calls to log the resolved absolute path and flag any path outside the workspace root
• Deploy filesystem auditing (auditd, eBPF) on hosts running praisonaiagents to alert on reads of credential and configuration files by the agent process
• Correlate prompt input telemetry with file access events to identify traversal patterns originating from user-controlled channels

Monitoring Recommendations

• Retain full prompt input and agent response logs to support retrospective hunting for traversal payloads
• Monitor process file descriptor activity for the Python interpreter hosting the agent runtime
• Alert on agent responses that echo the contents of files matching sensitive path patterns

How to Mitigate CVE-2026-57129

Immediate Actions Required

• Upgrade praisonaiagents to version 1.6.59 or later across all deployments
• Rotate any credentials, API keys, and tokens that were accessible to the agent process while a vulnerable version was running
• Audit prompt and mention logs for traversal payloads and enumerate any files that were read
• Restrict the agent process to the minimum filesystem scope required for its workflows

Patch Information

The fix is included in praisonaiagents1.6.59, published as GitHub Release v4.6.59. The patch enforces workspace-relative resolution and rejects mentions that resolve outside the configured workspace. Review the code change in the GitHub Commit Update and the GitHub Security Advisory GHSA-2rcg-mm5h-xchx for full technical context.

Workarounds

• Run the agent under a dedicated low-privilege user with filesystem access limited to the workspace directory
• Sanitize inbound prompt content to strip @ mentions containing absolute paths or .. sequences before reaching the parser
• Use container or sandbox isolation (chroot, mount namespaces, read-only bind mounts) to prevent access to secrets outside the workspace
• Move secrets out of the process environment and load them through a secrets manager with just-in-time retrieval

# Upgrade to the patched release
pip install --upgrade 'praisonaiagents>=1.6.59'

# Verify installed version
python -c "import praisonaiagents, sys; print(praisonaiagents.__version__)"