{"data":{"id":"7d5228a2-e7f9-423a-8f2a-fdee1f891e63","title":"GHSA-4xxv-6wmf-xf45: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace","summary":"PraisonAI's FastContext feature, in praisonaiagents.context.fast, treats workspace_path as the root for code search but does not confine its model-facing tools to that directory. The execute_tool() method leaves absolute paths unchanged and turns relative traversal paths such as ../outside-secret.txt into paths outside the workspace, and the downstream grep_search, read_file and list_directory functions resolve and read them. A lower-trust prompt or caller that can influence tool arguments can therefore read, search and enumerate files outside the intended project, with the content returned to the caller or injected into the model's tool-result context.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-4xxv-6wmf-xf45","publishedAt":"2026-10-08T16:48:52.000Z","cveId":"CVE-2026-61432","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["praisonaiagents@<= 1.6.77 (fixed: 1.6.78)"],"affectedPackageNames":["praisonaiagents"],"affectedVendors":[],"affectedVendorsRaw":["PraisonAI","FastContext"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00407,"epssCheckedAt":"2026-10-10T06:42:00.270Z","kevDateAdded":null,"advisoryAliases":["GHSA-4xxv-6wmf-xf45"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-08T16:48:52.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}