CVE-2026-56833: PraisonAI: path traversal exposes agent logs/history

HIGH

Published October 23, 2026

CISO Take

PraisonAI's Dynamic Context tools (versions 3.8.1 up to 4.6.58) accept run_id and agent_id from the tool caller and join them into filesystem paths without blocking absolute paths or '..' traversal. Any lower-trust prompt or user who can make the agent call these tools can read .jsonl and .log files outside the intended base directory, and those files commonly hold conversation history, tool outputs and terminal logs that may contain secrets. The CVSS is 7.5 (network, no privileges, confidentiality only), but there is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS data yet, and only 1 downstream dependent is recorded, so the blast radius is limited today. The package has 187 other CVEs, which points to a weak security track record and justifies prioritizing it in agent inventories. Upgrade PraisonAI to 4.6.59 or later, and until then restrict which users and prompts can reach agent tool calls and review file-read activity from the agent process.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium-high. Exploitation is trivial in principle (low complexity, no privileges, no user interaction) and requires only the ability to influence tool arguments, which prompt injection or any user-facing agent interface provides. Impact is confidentiality-only and restricted to files ending in .jsonl or .log, which limits the direct damage but can still leak other sessions' histories, credentials echoed in logs, API keys and internal data. There is no evidence of active exploitation, no public PoC and no KEV or SSVC signal, so likelihood is moderate rather than urgent.

How does the attack unfold?

Initial Access

Attacker reaches a PraisonAI agent through a user-facing interface or injected content and gains the ability to influence tool arguments.

AML.T0053

Exploitation

The agent calls the Dynamic Context tool with an absolute run_id and an agent_id containing '..' sequences, escaping the base directory.

AML.T0053

Collection

The store reads arbitrary .jsonl and .log files from the host and returns their contents to the attacker.

AML.T0037

Impact

Leaked histories, logs and embedded credentials enable data exposure and lateral movement into connected services.

AML.T0055

Initial Access

Attacker reaches a PraisonAI agent through a user-facing interface or injected content and gains the ability to influence tool arguments.

AML.T0053

Exploitation

The agent calls the Dynamic Context tool with an absolute run_id and an agent_id containing '..' sequences, escaping the base directory.

AML.T0053

Collection

The store reads arbitrary .jsonl and .log files from the host and returns their contents to the attacker.

AML.T0037

Impact

Leaked histories, logs and embedded credentials enable data exposure and lateral movement into connected services.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade PraisonAI to 4.6.59 or later (affects 3.8.1 through 4.6.58). 2) If you cannot upgrade immediately, remove or disable the Dynamic Context history and terminal-log tools from agents exposed to untrusted users, or wrap them with validation that rejects absolute paths and '..' in run_id and agent_id. 3) Run agent processes as a low-privilege user, in a container or sandbox with a read-only, minimal filesystem so readable .log and .jsonl files outside the base directory are limited. 4) Keep secrets out of agent logs and rotate any credentials that may have been written to .log or .jsonl files accessible to the agent. 5) Detect by searching tool-call logs for run_id or agent_id values that start with '/' or contain '../', and monitor the agent process for file reads outside the Dynamic Context base directory. 6) Review the GHSA-22cj-m4wf-fv2c advisory for the maintainers' guidance.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionData LeakageAgentFrameworkPluginAML.T0037- Data from Local System AML.T0053- AI Agent Tool Invocation AML.T0055- Unsecured Credentials AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-56833?

Is CVE-2026-56833 actively exploited?

No confirmed active exploitation of CVE-2026-56833 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56833?

1) Upgrade PraisonAI to 4.6.59 or later (affects 3.8.1 through 4.6.58). 2) If you cannot upgrade immediately, remove or disable the Dynamic Context history and terminal-log tools from agents exposed to untrusted users, or wrap them with validation that rejects absolute paths and '..' in run_id and agent_id. 3) Run agent processes as a low-privilege user, in a container or sandbox with a read-only, minimal filesystem so readable .log and .jsonl files outside the base directory are limited. 4) Keep secrets out of agent logs and rotate any credentials that may have been written to .log or .jsonl files accessible to the agent. 5) Detect by searching tool-call logs for run_id or agent_id values that start with '/' or contain '../', and monitor the agent process for file reads outside the Dynamic Context base directory. 6) Review the GHSA-22cj-m4wf-fv2c advisory for the maintainers' guidance.

What systems are affected by CVE-2026-56833?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, agent tool-calling pipelines, agent memory and context storage.

What is the CVSS score for CVE-2026-56833?

CVE-2026-56833 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.46%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemsagent tool-calling pipelinesagent memory and context storage

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0053AI Agent Tool Invocation

AML.T0055Unsecured Credentials

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.

Exploitation Scenario

An attacker interacts with a public or internal chat interface backed by a PraisonAI multi-agent team. They craft a prompt, or plant instructions in content the agent ingests, that makes the agent call the Dynamic Context history or terminal-log tool with run_id set to an absolute path such as /var/log/app and agent_id containing '../' sequences. The store joins these values without validation and returns the contents of arbitrary .log or .jsonl files, such as other users' agent histories or application logs containing API keys and tokens. The attacker then uses the harvested credentials to pivot into connected SaaS, cloud or model-provider accounts.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-200Exposure of Sensitive Information to an Unauthorized Actor CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.