CVE-2026-57122

In PraisonAI prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments using the advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation.

In PraisonAI prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files accessible to the service account, exposing credentials, keys, environment variables, and other local data.

In PraisonAI prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application exposing code_read_file, code_search_replace, or code_apply_diff before set_workspace can let prompt-influenced calls read and modify files outside the intended project directory.

In PraisonAI prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption.

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the shell command allowlist by using find's built-in actions (-exec, -execdir, -delete). Attackers can execute unauthorized commands, read or delete files without triggering shell metacharacter filters.

A path traversal vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 in the FastContext feature. The FastContextAgent.execute_tool() function does not properly validate absolute paths or canonicalize relative paths, allowing reading, searching, and enumerating files outside the intended workspace directory.

PraisonAI before version 4.6.78 contains a path traversal vulnerability in the ContextGatherer component that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.

PraisonAI before version 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

A vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml without validating the output.output_file path. An attacker can set this path to an absolute or '..' traversal path, causing agent.start() without an output parameter to overwrite files outside the project root.

In the multi-agent system PraisonAI prior to version 4.6.37, a vulnerability allows the exploitation of symlinks to write arbitrary data to a chosen location on the victim's filesystem. The issue stems from the lack of validation for member.linkname and not rejecting symlink/hardlink members.