Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M
CVE-2026-56834PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
High 7.5
In plain English
A high-severity path traversal in PraisonAI from MervinPraison. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_path is an artifact created by the configured store or that it lives under the configured artifact base directory. Instead, artifact_head, artifact_tail, artifact_grep, and artifact_chunk wrap the caller-supplied path directly into an ArtifactRef and then read it from the host filesystem. As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data. This issue has been patched in version 4.6.59.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | praisonai | 4.6.59 | GHSA-j7qx-p75m-wp7g |
| PyPI | praisonai | 4.6.59 | PYSEC-2026-3514 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MervinPraison | PraisonAI | >= 3.8.1, < 4.6.59 |
Weakness: CWE-22, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N