Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-61432 · GHSA-4xxv-6wmf-xf45

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

Risk score
46/100
CVSS
5.7 v3.1
Exploit chance (30 days)
0.4%
Published
10 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing …
Affected
praisonaiagents (pip) <= 1.6.77
Fix
Upgrade praisonaiagents to 1.6.78 or later.
Exploitation
No known exploitation

Story map

Story map: praisonaiagentsTHE FLAWSTHE FIXCVE-2026-61432PraisonAI: FastContext pathresolution permits absolute andtraversal reads outside the…CVSS 5.7 · EPSS 0%CVE-2026-61447PraisonAI: CodeAgent ExecutesLLM-Generated Code WithoutSandboxing and Leaks All…CVSS 10.0 · EPSS 2%CVE-2026-61430PraisonAI: DNS rebindingbypass in `web_crawl` SSRFprotection allows internal…CVSS 8.5 · EPSS 0%CVE-2026-61429PraisonAI:Crawl4AI/Chromium backend isalso affected by the…CVSS 8.5 · EPSS 0%Upgrade praisonaiagents1.6.78or later on your release lineWho is exposedpraisonaiagents (pip) <= 1.6.77RED · ACT TODAYpraisonaiagentsCodeAgent._execute_python()executes LLM-generated Pythoncode in a subprocess with thecomplete parent-processenvironment (os.environ.copy()),zero AST validation, zero importrestrictions, and no sandbox…Where it standsPublic proof of conceptCONNECTS TOSame weaknessPath traversal (CWE-22)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

praisonaiagents: Red, act today. CodeAgent._execute_python() executes LLM-generated Python code in a subprocess with the complete parent-process environment (os.environ.copy()), zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfig(sandbox=True) is explicitly set. This allows an attacker who can influence LL…

The flaws

  • CVE-2026-61432: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace (CVSS 5.7 · EPSS 0%)
  • CVE-2026-61447: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets (CVSS 10.0 · EPSS 2%)
  • CVE-2026-61430: PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure (CVSS 8.5 · EPSS 0%)
  • CVE-2026-61429: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass (CVSS 8.5 · EPSS 0%)

The fix

Upgrade praisonaiagents: 1.6.78 or later on your release line

Who is exposed: praisonaiagents (pip) <= 1.6.77

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.7 medium
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
praisonaiagentspip<= 1.6.771.6.78

References

Original description

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.

Last activity 8 Oct 2026. Patch Forecast updates every hour.