{"id":"CVE-2026-56833","kind":"vulnerability","aliases":["CVE-2026-56833"],"related":[],"title":"PraisonAI: agent tools let callers read files outside storage directory","description":"PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.","summary":"PraisonAI's Dynamic Context tools accept run_id and agent_id values that are joined into filesystem paths without checking for absolute paths or .. traversal. A caller who can invoke these tools can read .jsonl and .log files outside the configured base directory.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","praisonai","python"],"not_affected_if":["dynamic-context-unused","trusted-callers-only"],"how_to_check":"- Check the installed PraisonAI version with `pip show praisonai` or `pip show praisonaiagents` and confirm whether it is between `3.8.1` and `4.6.59`\n- Search your code for uses of the Dynamic Context history or terminal-log tool factories that pass run_id or agent_id from user or prompt input","fix":"- Upgrade PraisonAI to `4.6.59` or later\n- Until upgraded, do not expose Dynamic Context tools to lower-trust prompts or users","status":"open","published_at":"2026-10-23T12:18:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T03:14:55+00:00","updated_at":"2026-10-25T03:14:55+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:14:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PraisonAI to `4.6.59` or later\n- Until upgraded, do not expose Dynamic Context tools to lower-trust prompts or users","reach":"unknown","title":"PraisonAI: agent tools let callers read files outside storage directory","impact":"medium","summary":"PraisonAI's Dynamic Context tools accept run_id and agent_id values that are joined into filesystem paths without checking for absolute paths or .. traversal. A caller who can invoke these tools can read .jsonl and .log files outside the configured base directory.","category":"ai-tooling","nicknames":[],"who_cares":["python","ai-agents","praisonai"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Arbitrary .jsonl and .log files readable from the host filesystem","analyst_note":"Confirm whether the Dynamic Context tools are enabled by default and what calling privileges a prompt or user needs; the NVD entry is the only source.","how_to_check":"- Check the installed PraisonAI version with `pip show praisonai` or `pip show praisonaiagents` and confirm whether it is between `3.8.1` and `4.6.59`\n- Search your code for uses of the Dynamic Context history or terminal-log tool factories that pass run_id or agent_id from user or prompt input","needs_analyst":true,"not_affected_if":["dynamic-context-unused","trusted-callers-only"],"who_is_affected":"Teams running PraisonAI from 3.8.1 up to but not including 4.6.59 that use the Dynamic Context module and expose its tools to prompts or users who should not read the host filesystem. Deployments that do not use Dynamic Context, or where only trusted operators call the tools, are less exposed. The sources do not say how widely the tools are enabled by default.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":3421,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-56833':13A,16A '3.8.1':78C '4.6.59':82C,179C 'absolut':46B,131C,141C 'accept':30B,109C 'agent':2A,19B,34B,73C,103C,113C,144C 'agent-cal':102C 'ai':18B,21B 'ai-ag':17B 'ai-tool':20B 'also':100C 'argument':115C 'back':91C 'base':66B,170C 'call':156C 'callabl':104C 'caller':5A,51B,119C 'check':44B 'configur':65B,167C 'contain':147C 'context':28B,86C,169C 'cve':11A,14A 'directori':10A,67B,171C 'dynam':27B,85C,168C 'export':101C 'factori':106C 'file':7A,62B,164C 'filesystem':41B,90C,127C 'filesystem-back':89C 'histori':92C 'id':32B,35B,111C,114C,137C,145C 'invok':54B 'issu':173C 'join':39B,123C 'jsonl':59B,161C 'let':4A 'log':61B,96C,163C 'lower':151C 'lower-trust':150C 'modul':87C,99C 'multi':72C 'multi-ag':71C 'outsid':8A,63B,165C 'patch':176C 'path':42B,47B,128C,132C,142C 'praisonai':1A,23B,25B,68C,83C 'prompt/user':153C 'provid':88C 'python':24B 'read':6A,58B,160C 'reject':130C 'run':31B,110C,136C 'storag':9A,97C 'store':122C 'system':75C 'team':74C 'termin':95C 'terminal-log':94C 'tool':3A,22B,29B,56B,105C,108C,118C,158C 'travers':49B,134C,148C 'trust':152C 'under':121C 'valu':36B,125C 'version':77C,81C,178C 'without':43B,129C","nicknames":[],"mitigations":[],"who_affected":"Teams running PraisonAI from 3.8.1 up to but not including 4.6.59 that use the Dynamic Context module and expose its tools to prompts or users who should not read the host filesystem. Deployments that do not use Dynamic Context, or where only trusted operators call the tools, are less exposed. The sources do not say how widely the tools are enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56833","severity":null,"published_at":"2026-10-23T12:18:14+00:00","modified_at":"2026-10-23T21:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}