CVE-2026-61432: PraisonAI Path Traversal Vulnerability

CVE-2026-61432 Overview

CVE-2026-61432 is a path traversal vulnerability [CWE-22] affecting PraisonAI (praisonaiagents) versions before 1.6.78. The flaw resides in the FastContext feature (praisonaiagents.context.fast), where FastContextAgent.execute_tool() fails to properly validate file paths passed to tool functions. The method prepends the configured workspace_path only for relative paths, and it neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. Attackers or model-generated tool calls can invoke grep_search, glob_search, read_file, or list_directory with absolute paths or ../ sequences to read files outside the intended workspace.

Critical Impact
An attacker who influences tool arguments or LLM-generated function calls can enumerate and exfiltrate arbitrary files readable by the PraisonAI process, including secrets, source code, and configuration files outside the workspace boundary.

Affected Products

PraisonAI praisonaiagents package versions prior to 1.6.78
Applications integrating the FastContext feature (praisonaiagents.context.fast)
Deployments exposing FastContextAgent tools to untrusted input or LLM-generated calls

Discovery Timeline

2026-07-10 - CVE-2026-61432 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-61432

Vulnerability Analysis

The vulnerability originates in FastContextAgent.execute_tool(), the dispatcher that routes tool invocations to filesystem helpers within praisonaiagents.context.fast. The dispatcher applies workspace prefixing selectively: it prepends workspace_path only when the caller-supplied path is relative. Absolute paths bypass the prefixing logic entirely, and no canonicalization step resolves symbolic links or ../ segments before enforcing containment checks.

The affected tools include grep_search, glob_search, read_file, and list_directory. Each function accepts a path argument that flows from either explicit tool arguments or model-generated function calls. Because the containment check runs against the raw joined path, attackers can supply /etc/passwd or ../../etc/shadow and reach any file readable by the process. Retrieved content is returned to the caller and injected into the model's tool-result context, expanding both direct data exposure and prompt-injection attack surface.

Root Cause

The root cause is missing input canonicalization and incomplete absolute-path handling in a security-sensitive path-joining routine. The code trusts the shape of the input, treating a leading / as intentional rather than as an escape from the workspace sandbox. Effective containment requires resolving the joined path with os.path.realpath() (or equivalent) and verifying that the resolved path is a descendant of the resolved workspace root before performing any filesystem operation.

Attack Vector

Exploitation requires an attacker to influence the arguments passed to a FastContext tool. This occurs in two scenarios. First, an authenticated user of an application built on PraisonAI can submit crafted tool arguments directly. Second, indirect prompt injection through documents, web content, or other model-consumed data can cause the LLM to emit tool calls targeting attacker-chosen paths. In both cases, the vulnerability is reachable over the network when the agent is exposed through an API.

The vulnerability manifests when FastContextAgent.execute_tool() receives a path argument such as /etc/passwd or workspace/../../root/.ssh/id_rsa. See the GitHub Security Advisory and the VulnCheck Advisory for further technical detail. The remediation is tracked in the GitHub Commit Overview.

Detection Methods for CVE-2026-61432

Indicators of Compromise

Tool-call logs from FastContextAgent containing absolute paths (starting with / on Unix or a drive letter on Windows) supplied to read_file, grep_search, glob_search, or list_directory.
Path arguments containing ../ or ..\ traversal sequences in agent audit logs.
Unexpected read access to sensitive files such as /etc/passwd, /etc/shadow, ~/.ssh/, .env, or cloud credential files by the PraisonAI process user.
Model tool-result contexts containing content from files outside the configured workspace_path.

Detection Strategies

Instrument execute_tool() call sites to log every resolved path alongside the configured workspace_path, and alert when the resolved path is not a descendant.
Inspect prompt and tool-invocation telemetry for arguments matching path-traversal regex patterns such as \.\.[\\/] or paths beginning with /, \, or [A-Za-z]:.
Correlate LLM-generated function-call arguments with process-level file access events to identify reads outside the workspace directory.

Monitoring Recommendations

Enable filesystem access auditing (auditd, Windows Security auditing) for the account running PraisonAI, focusing on sensitive directories.
Ship agent tool-call logs to a centralized SIEM and build detections for path-traversal patterns in praisonaiagents events.
Monitor package inventories for installations of praisonaiagents versions below 1.6.78.

How to Mitigate CVE-2026-61432

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.78 or later in all environments using FastContext.
Audit existing agent applications to identify which tools expose filesystem access to LLM-generated arguments.
Rotate any secrets or credentials that resided on hosts running vulnerable versions with untrusted tool inputs.
Restrict the process user running PraisonAI to the minimum filesystem permissions required for the workspace.

Patch Information

The fix is delivered in praisonaiagents1.6.78. The upstream remediation is referenced in the GitHub Commit Overview and the GitHub Security Advisory GHSA-4xxv-6wmf-xf45. Upgrading is the recommended remediation because the patch adds absolute-path rejection and canonicalized containment checks in FastContextAgent.execute_tool().

Workarounds

Wrap FastContext tools with a validator that rejects absolute paths and any argument containing .. segments before dispatch.
Run PraisonAI in a filesystem sandbox such as a container, chroot, or dedicated user account with read access limited to the workspace directory.
Disable or remove grep_search, glob_search, read_file, and list_directory tools from agent configurations that do not require them.
Apply strict input filtering to any user content that reaches the model to reduce indirect prompt-injection risk against the affected tools.

bash

# Upgrade praisonaiagents to the patched release
pip install --upgrade 'praisonaiagents>=1.6.78'

# Verify the installed version
python -c "import praisonaiagents; print(praisonaiagents.__version__)"