TI-2026-44037 Aliases CVE-2026-61432 GHSA-3f4v-mp44-x4x2 GHSA-4xxv-6wmf-xf45

PraisonAI FastContext before 1.6.78 Path Traversal

MEDIUM 64CWE-22Published 2026-07-10 · Updated 2026-07-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00343 27th percentileScored 2026-11-07

Fix Fixed PraisonAI (MervinPraison): 1.6.78praisonaiagents (PyPI): 1.6.78

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MervinPraison	PraisonAI	before 1.6.78	1.6.78	Patch available	CNA
—	praisonaiagents (PyPI)	before 1.6.78	1.6.78	Patch available	GHSA-4xxv-6wmf-xf45

PraisonAI VendorMervinPraison Affected before 1.6.78 Fixed in 1.6.78 Patch available CNA
praisonaiagents (PyPI) Vendor— Affected before 1.6.78 Fixed in 1.6.78 Patch available GHSA-4xxv-6wmf-xf45

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:praison:praisonai::::::::	—	—	MervinPraison

cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions — — ·MervinPraison

Remediation

Fix · CNA PraisonAI (MervinPraison) Fixed in 1.6.78
Fix · GHSA-4xxv-6wmf-xf45 praisonaiagents (PyPI) Fixed in 1.6.78 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-07-10
MervinPraison PraisonAI 1.6.78
3 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM
Other records, highest priority first
- TI-2026-44042 PraisonAI before 1.6.78 Remote Code Execution via tools.pyPriority HIGH 72
- TI-2026-42819 PraisonAI before 1.6.78 Path Traversal via config.tomlPriority MEDIUM 64
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-61432
2026-10-03 Alias added: GHSA-3f4v-mp44-x4x2
2026-10-08 Alias added: GHSA-4xxv-6wmf-xf45
2026-10-08 Fix available: PyPI/[email protected] · GHSA-4xxv-6wmf-xf45
2026-10-08 CVSS score added · GHSA-4xxv-6wmf-xf45
2026-10-08 Weakness changed · GHSA-4xxv-6wmf-xf45
2026-10-08 4 new references · GHSA-4xxv-6wmf-xf45

References

Patch 1

https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0

Advisory 2

Other 1

https://github.com/MervinPraison/PraisonAI

TI-2026-79619 Missing authentication in PraisonAI AgentOS exposes agent chat CVSS 3.1CRITICAL 9.8
TI-2026-71236 Missing access control in PraisonAI AgentTeam exposes agent endpoints CVSS 3.1CRITICAL 9.8
TI-2026-44052 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent CVSS 4.0CRITICAL 10.0
TI-2026-41123 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) CVSS 3.1CRITICAL 9.8
TI-2026-41122 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery CVSS 3.1CRITICAL 9.8
TI-2026-41118 PraisonAI MCPServer exposes unauthenticated HTTP tools/call CVSS 3.1CRITICAL 9.8

See all 177 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences