{"data":{"id":"82d0dd32-a482-489f-afe6-1a86dfe659a4","title":"GHSA-29w3-p9w9-wc47: PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation","summary":"The `multiedit` tool in PraisonAI (`src/praisonai/praisonai/tools/multiedit.py`) passes the `filepath` parameter directly to `open()` for reads and writes, with no path traversal check, workspace boundary validation, protected path guard or symlink resolution. An attacker who can influence agent tool arguments, through crafted prompts, chat bot input or malicious YAML workflow configs, can read sensitive files and overwrite arbitrary files the process user can access. The advisory's proof of concept confirmed an arbitrary file write to a file outside the workspace.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-29w3-p9w9-wc47","publishedAt":"2026-06-18T14:27:03.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["praisonai@< 4.6.61 (fixed: 4.6.61)"],"affectedPackageNames":["praisonai"],"affectedPackageRefs":["pypi:praisonai"],"affectedVendors":[],"affectedVendorsRaw":["PraisonAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-29w3-p9w9-wc47"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-18T14:27:03.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:34:20.184Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"pypi","name":"praisonai","fixedVersion":"4.6.61","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"registry","status":"version_not_found","checkedAt":"2026-10-29T21:34:20.038Z"}]}}