PT-2026-57192 · Mervinpraison · Praisonai

Rexpository · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-61432

Mitre

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute tool() prepends the configured workspace path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep search, glob search, read file, or list directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-61432

Affected Products

Praisonai

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-61432 · Security Note
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4xxv-6wmf-xf45 · Vendor Advisory
• https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0 · Patch
• https://vulncheck.com/advisories/praisonai-fastcontext-before-path-traversal · Note