GHSA-29w3-p9w9-wc47: PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

Summary

The `multiedit` tool in PraisonAI (`src/praisonai/praisonai/tools/multiedit.py`) passes the `filepath` parameter directly to `open()` for reads and writes, with no path traversal check, workspace boundary validation, protected path guard or symlink resolution. An attacker who can influence agent tool arguments, through crafted prompts, chat bot input or malicious YAML workflow configs, can read sensitive files and overwrite arbitrary files the process user can access. The advisory's proof of concept confirmed an arbitrary file write to a file outside the workspace.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database