CVE-2026-61432

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-4xxv-6wmf-xf45. This link is maintained to preserve external references.

Original Description

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.

FastContext path resolution permits absolute and traversal reads outside the workspace

Summary

PraisonAI's praisonaiagents.context.fast FastContext feature treats workspace_path as the root directory for code search, but its model-facing search tools and high-level read_context() helper accept absolute paths and .. traversal paths without checking that the resolved path remains under that workspace. A lower-trust prompt or caller that can influence FastContext tool arguments can read, search, and enumerate files outside the intended project workspace; the resulting file content is then returned to the caller or injected into the model's tool-result context.

Technical Details

FastContextAgent documents workspace_path as the "Root directory for searches" and stores it as an absolute path:

class FastContextAgent:
    """Specialized agent for fast parallel code search.

    Attributes:
        workspace_path: Root directory for searches
    """

    def __init__(self, workspace_path: str, ...):
        self.workspace_path = os.path.abspath(workspace_path)

The same class exposes grep_search, glob_search, read_file, and list_directory as model function-call tools via get_tools(). Those tools are intended to retrieve code context from the configured workspace.

The problem is in FastContextAgent.execute_tool(). It prepends workspace_path only when the caller supplies a relative path, but it does not reject absolute paths and does not canonicalize the joined relative path before enforcing containment:

if tool_name in ("grep_search", "glob_search"):
    if "search_path" not in kwargs or kwargs["search_path"] == ".":
        kwargs["search_path"] = self.workspace_path
    elif not os.path.isabs(kwargs["search_path"]):
        kwargs["search_path"] = os.path.join(self.workspace_path, kwargs["search_path"])
elif tool_name == "list_directory":
    if "dir_path" not in kwargs or kwargs["dir_path"] == ".":
        kwargs["dir_path"] = self.workspace_path
    elif not os.path.isabs(kwargs["dir_path"]):
        kwargs["dir_path"] = os.path.join(self.workspace_path, kwargs["dir_path"])
elif tool_name == "read_file":
    if "filepath" in kwargs and not os.path.isabs(kwargs["filepath"]):
        kwargs["filepath"] = os.path.join(self.workspace_path, kwargs["filepath"])

As a result, an absolute path passes through unchanged, and a relative traversal such as ../outside-secret.txt is transformed into <workspace>/../outside-secret.txt. The downstream search tools then call os.path.abspath() and operate on the resolved outside path.

The downstream tools do not enforce a FastContext workspace boundary:

def grep_search(search_path: str, pattern: str, ...):
    search_path = os.path.abspath(search_path)
    ...
    with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
        lines = f.readlines()

def read_file(filepath: str, ...):
    filepath = os.path.abspath(filepath)
    ...
    with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
        lines = f.readlines()

def list_directory(dir_path: str, ...):
    dir_path = os.path.abspath(dir_path)
    ...
    for entry in os.scandir(path):
        ...

The model-backed FastContextAgent.search() path is also affected. It sends the FastContext tools to the model, parses model-supplied tool-call JSON, and adds those arguments to a ToolCallBatch:

response = model_client.chat.completions.create(
    model=self.model,
    messages=messages,
    tools=[{"type": "function", "function": t} for t in self.get_tools()],
    tool_choice="auto"
)
...
args = json.loads(tool_call.function.arguments)
batch.add(tool_call.function.name, **args)
...
tool_results = self.coordinator.execute_turn_sync(batch)

That path bypasses execute_tool()'s incomplete workspace-prefixing entirely and sends model-generated paths directly to the raw filesystem search functions…

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-4xxv-6wmf-xf45. This link is maintained to preserve external references.

Original Description

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.

FastContext path resolution permits absolute and traversal reads outside the workspace

Summary

PraisonAI's praisonaiagents.context.fast FastContext feature treats workspace_path as the root directory for code search, but its model-facing search tools and high-level read_context() helper accept absolute paths and .. traversal paths without checking that the resolved path remains under that workspace. A lower-trust prompt or caller that can influence FastContext tool arguments can read, search, and enumerate files outside the intended project workspace; the resulting file content is then returned to the caller or injected into the model's tool-result context.

Technical Details

FastContextAgent documents workspace_path as the "Root directory for searches" and stores it as an absolute path:

class FastContextAgent:
    """Specialized agent for fast parallel code search.

    Attributes:
        workspace_path: Root directory for searches
    """

    def __init__(self, workspace_path: str, ...):
        self.workspace_path = os.path.abspath(workspace_path)

The same class exposes grep_search, glob_search, read_file, and list_directory as model function-call tools via get_tools(). Those tools are intended to retrieve code context from the configured workspace.

The problem is in FastContextAgent.execute_tool(). It prepends workspace_path only when the caller supplies a relative path, but it does not reject absolute paths and does not canonicalize the joined relative path before enforcing containment:

if tool_name in ("grep_search", "glob_search"):
    if "search_path" not in kwargs or kwargs["search_path"] == ".":
        kwargs["search_path"] = self.workspace_path
    elif not os.path.isabs(kwargs["search_path"]):
        kwargs["search_path"] = os.path.join(self.workspace_path, kwargs["search_path"])
elif tool_name == "list_directory":
    if "dir_path" not in kwargs or kwargs["dir_path"] == ".":
        kwargs["dir_path"] = self.workspace_path
    elif not os.path.isabs(kwargs["dir_path"]):
        kwargs["dir_path"] = os.path.join(self.workspace_path, kwargs["dir_path"])
elif tool_name == "read_file":
    if "filepath" in kwargs and not os.path.isabs(kwargs["filepath"]):
        kwargs["filepath"] = os.path.join(self.workspace_path, kwargs["filepath"])

As a result, an absolute path passes through unchanged, and a relative traversal such as ../outside-secret.txt is transformed into <workspace>/../outside-secret.txt. The downstream search tools then call os.path.abspath() and operate on the resolved outside path.

The downstream tools do not enforce a FastContext workspace boundary:

def grep_search(search_path: str, pattern: str, ...):
    search_path = os.path.abspath(search_path)
    ...
    with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
        lines = f.readlines()

def read_file(filepath: str, ...):
    filepath = os.path.abspath(filepath)
    ...
    with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
        lines = f.readlines()

def list_directory(dir_path: str, ...):
    dir_path = os.path.abspath(dir_path)
    ...
    for entry in os.scandir(path):
        ...

The model-backed FastContextAgent.search() path is also affected. It sends the FastContext tools to the model, parses model-supplied tool-call JSON, and adds those arguments to a ToolCallBatch:

response = model_client.chat.completions.create(
    model=self.model,
    messages=messages,
    tools=[{"type": "function", "function": t} for t in self.get_tools()],
    tool_choice="auto"
)
...
args = json.loads(tool_call.function.arguments)
batch.add(tool_call.function.name, **args)
...
tool_results = self.coordinator.execute_turn_sync(batch)

That path bypasses execute_tool()'s incomplete workspace-prefixing entirely and sends model-generated paths directly to the raw filesystem search functions…

FastContext path resolution permits absolute and traversal reads outside the workspace

Summary

PraisonAI's praisonaiagents.context.fast FastContext feature treats workspace_path as the root directory for code search, but its model-facing search tools and high-level read_context() helper accept absolute paths and .. traversal paths without checking that the resolved path remains under that workspace. A lower-trust prompt or caller that can influence FastContext tool arguments can read, search, and enumerate files outside the intended project workspace; the resulting file content is then returned to the caller or injected into the model's tool-result context.

Technical Details

FastContextAgent documents workspace_path as the "Root directory for searches" and stores it as an absolute path:

class FastContextAgent:
    """Specialized agent for fast parallel code search.

    Attributes:
        workspace_path: Root directory for searches
    """

    def __init__(self, workspace_path: str, ...):
        self.workspace_path = os.path.abspath(workspace_path)

The same class exposes grep_search, glob_search, read_file, and list_directory as model function-call tools via get_tools(). Those tools are intended to retrieve code context from the configured workspace.

The problem is in FastContextAgent.execute_tool(). It prepends workspace_path only when the caller supplies a relative path, but it does not reject absolute paths and does not canonicalize the joined relative path before enforcing containment:

if tool_name in ("grep_search", "glob_search"):
    if "search_path" not in kwargs or kwargs["search_path"] == ".":
        kwargs["search_path"] = self.workspace_path
    elif not os.path.isabs(kwargs["search_path"]):
        kwargs["search_path"] = os.path.join(self.workspace_path, kwargs["search_path"])
elif tool_name == "list_directory":
    if "dir_path" not in kwargs or kwargs["dir_path"] == ".":
        kwargs["dir_path"] = self.workspace_path
    elif not os.path.isabs(kwargs["dir_path"]):
        kwargs["dir_path"] = os.path.join(self.workspace_path, kwargs["dir_path"])
elif tool_name == "read_file":
    if "filepath" in kwargs and not os.path.isabs(kwargs["filepath"]):
        kwargs["filepath"] = os.path.join(self.workspace_path, kwargs["filepath"])

As a result, an absolute path passes through unchanged, and a relative traversal such as ../outside-secret.txt is transformed into <workspace>/../outside-secret.txt. The downstream search tools then call os.path.abspath() and operate on the resolved outside path.

The downstream tools do not enforce a FastContext workspace boundary:

def grep_search(search_path: str, pattern: str, ...):
    search_path = os.path.abspath(search_path)
    ...
    with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
        lines = f.readlines()

def read_file(filepath: str, ...):
    filepath = os.path.abspath(filepath)
    ...
    with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
        lines = f.readlines()

def list_directory(dir_path: str, ...):
    dir_path = os.path.abspath(dir_path)
    ...
    for entry in os.scandir(path):
        ...

The model-backed FastContextAgent.search() path is also affected. It sends the FastContext tools to the model, parses model-supplied tool-call JSON, and adds those arguments to a ToolCallBatch:

response = model_client.chat.completions.create(
    model=self.model,
    messages=messages,
    tools=[{"type": "function", "function": t} for t in self.get_tools()],
    tool_choice="auto"
)
...
args = json.loads(tool_call.function.arguments)
batch.add(tool_call.function.name, **args)
...
tool_results = self.coordinator.execute_turn_sync(batch)

That path bypasses execute_tool()'s incomplete workspace-prefixing entirely and sends model-generated paths directly to the raw filesystem search functions…