PT-2026-61799 · Praisonai · Praisonai

CVE-2026-57145 · Published 2026-06-18 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PraisonAI (affected versions not specified)

Description The multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows arbitrary file read and write operations because it lacks path validation, workspace boundary checks, and protected path guards. An attacker who can influence the filepath parameter—through crafted prompts, user input in chat bots, or malicious YAML workflow configurations—can read sensitive files such as SSH keys and cloud credentials, or overwrite arbitrary files on the filesystem to achieve privilege escalation.

Recommendations Implement a validate path function to reject paths containing .., resolve symlinks using os.path.realpath, and ensure the resolved path is within the workspace using os.path.commonpath. Add protected path guards to prevent access to sensitive files like .env, .git, and .ssh. Apply the validate path function to the filepath parameter before any open() call. Add the @require approval(risk level="high") decorator to the multiedit function. As a temporary mitigation, restrict the use of the multiedit tool or disable auto approve tools in chat bot deployments.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-57145

GHSA-29W3-P9W9-WC47

PYSEC-2026-3500

Affected Products

Praisonai

References · 7

• https://osv.dev/vulnerability/GHSA-29w3-p9w9-wc47 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-3500 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-57145 · Security Note
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29w3-p9w9-wc47 · Note
• https://github.com/MervinPraison/PraisonAI · Note
• https://github.com/advisories/GHSA-29w3-p9w9-wc47 · Note
• https://pypi.org/project/praisonai · Note