HighVulnerabilityLLM-specific

GHSA-hvhp-v2gc-268q: PraisonAI has an Arbitrary File Write in Python API

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-47397GHSA-hvhp-v2gc-268q
Published: May 29, 2026
Record updated: October 9, 2026

Affected: PraisonAI <= 4.6.39
Fixed in: 4.6.40
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.5%

Summary

PraisonAI versions up to and including 4.6.37 skip path validation in `write_file` (`code/tools/write_file.py:77-83`) when `workspace=None`. Hidden metadata on a crawled webpage can then cause an agent to call `write_file` autonomously and write attacker-chosen content to an arbitrary path.

Mitigation

Fix: if `workspace` is None, set it to `os.getcwd()` and reject paths outside it with `{'success': False, 'error': 'Path outside workspace'}` (using `is_path_within_directory`).

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.5%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 12, 2026.
Disclosure date: May 29, 2026

Weaknesses and techniques

AI threat technique (MITRE ATLAS): AML.T0051

Affected

Packages: PraisonAI@<= 4.6.39 (fixed: 4.6.40)

Classification

Attack type: Prompt injection,
Other
Attack sophistication: Trivial
AI component targeted: Agent
Impact: Integrity,
Confidentiality
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-hvhp-v2gc-268q

First tracked: May 29, 2026 at 08:00 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 95% (self-assessed)

Summary

Mitigation

Related items