Live › vulnerability › CVE-2026-56833
Go to dashboardPraisonAI's Dynamic Context tools accept run_id and agent_id values that are joined into filesystem paths without checking for absolute paths or .. traversal. A caller who can invoke these tools can read .jsonl and .log files outside the configured base directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running PraisonAI from 3.8.1 up to but not including 4.6.59 that use the Dynamic Context module and expose its tools to prompts or users who should not read the host filesystem. Deployments that do not use Dynamic Context, or where only trusted operators call the tools, are less exposed. The sources do not say how widely the tools are enabled by default.
No product ranges from the sources yet.
pip show praisonai or pip show praisonaiagents and confirm whether it is between 3.8.1 and 4.6.594.6.59 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.
This page as .md · .json · in your agent: get_signal("CVE-2026-56833")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.