PT-2026-61783 · Pypi · Praisonaiagents
CVE-2026-57129
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
praisonai-agents (affected versions not specified)
Description
The
MentionsParser in src/praisonai-agents/praisonaiagents/tools/mentions.py allows reading arbitrary files from the filesystem. When processing @file: mentions in agent prompts, the parser attempts to resolve the path relative to the workspace; if the file is not found, it falls back to using the provided path as an absolute path without validation. This lack of boundary checks or path traversal validation allows an attacker who can influence agent prompts—via chat messages (Telegram, Discord, Slack), web UI input, or YAML workflow configurations—to read any file accessible to the process user, such as secrets, credentials, and system files. The issue occurs within the process file mention() function when handling the file path variable.Recommendations
Remove the absolute path fallback in the
process file mention() function to ensure files are only resolved within the workspace path.
Implement symlink resolution using .resolve() to prevent symlink-based traversal.
Add a protected path guard to block access to sensitive files like .env, .git, and .ssh directories.
Apply path validation using os.path.commonpath to ensure the resolved path remains within the intended directory.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Praisonaiagents