CVE-2026-48168

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the shell command allowlist by using find's built-in actions (-exec, -execdir, -delete). Attackers can execute unauthorized commands, read or delete files without triggering shell metacharacter filters.

A path traversal vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 in the FastContext feature. The FastContextAgent.execute_tool() function does not properly validate absolute paths or canonicalize relative paths, allowing reading, searching, and enumerating files outside the intended workspace directory.

PraisonAI before version 4.6.78 contains a path traversal vulnerability in the ContextGatherer component that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.

PraisonAI before version 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

A vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml without validating the output.output_file path. An attacker can set this path to an absolute or '..' traversal path, causing agent.start() without an output parameter to overwrite files outside the project root.

In the multi-agent system PraisonAI prior to version 4.6.37, a vulnerability allows the exploitation of symlinks to write arbitrary data to a chosen location on the victim's filesystem. The issue stems from the lack of validation for member.linkname and not rejecting symlink/hardlink members.

In the multi-agent system PraisonAI, versions from 4.5.139 to before 4.6.32 have a vulnerability related to unauthorized file imports. The tool_override.py file lacks safeguards, allowing remote code execution by an attacker.

In PraisonAI prior to 0.1.6, when PLATFORM_JWT_SECRET is unset, the public dev-secret-change-me HS256 signing key is used, and startup and token-issuance guards are disabled because PLATFORM_ENV defaults to dev. An unauthenticated attacker can sign a JWT with an arbitrary sub value that is accepted as an authenticated identity, enabling impersonation of a user or workspace owner.

In PraisonAI prior to 0.1.6, when PLATFORM_JWT_SECRET is unset, JWT_SECRET is assigned the public dev-secret-change-me value, and its production guard does not run when PLATFORM_ENV is also unset (defaults to dev). A remote unauthenticated attacker can mint an HS256 token with arbitrary sub and email, which is accepted by AuthService._verify_token() and get_current_user for protected API routes.

In PraisonAI prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regex blocklist can be bypassed with Function('return this')() to recover the global object and by dynamically constructing the child_process module name. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials, and execute OS commands with PraisonAI process privileges.