AI Threat AlertCVE-2026-56839: PraisonAI: path traversal escapes agent workspace sandbox
HIGHPoC AVAILABLECISA: ATTENDPraisonAI's code-tool wrappers (code_read_file, code_search_replace, code_apply_diff) only enforce path containment when a workspace has been explicitly set via set_workspace; until then, _workspace_root stays None and the containment check is silently bypassed, letting prompt-influenced tool calls read and overwrite files anywhere the process can reach. Any application that exposes these tools to an agent before calling set_workspace inherits an attacker-reachable arbitrary file read/write primitive, with confidentiality and integrity both rated High in the CVSS vector and no authentication beyond low privileges and some form of user interaction required. There is no evidence of active exploitation (not in CISA KEV, no EPSS data, no public PoC or Nuclei template), but the fix is trivial to adopt and the exposure window is easy to hit by accident in any deployment that initializes agents before configuring their workspace. Upgrade to praisonai 4.6.59 or later immediately; if you cannot patch right away, ensure set_workspace is called before any of the CODE_TOOLS are registered or exposed to agent/tool-calling flows, and audit deployment code for that ordering.
How severe is it?
What is the attack surface?
What should I do?
No patch available
Monitor for updates. Consider compensating controls or temporary mitigations.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2026-56839?
PraisonAI's code-tool wrappers (code_read_file, code_search_replace, code_apply_diff) only enforce path containment when a workspace has been explicitly set via set_workspace; until then, _workspace_root stays None and the containment check is silently bypassed, letting prompt-influenced tool calls read and overwrite files anywhere the process can reach. Any application that exposes these tools to an agent before calling set_workspace inherits an attacker-reachable arbitrary file read/write primitive, with confidentiality and integrity both rated High in the CVSS vector and no authentication beyond low privileges and some form of user interaction required. There is no evidence of active exploitation (not in CISA KEV, no EPSS data, no public PoC or Nuclei template), but the fix is trivial to adopt and the exposure window is easy to hit by accident in any deployment that initializes agents before configuring their workspace. Upgrade to praisonai 4.6.59 or later immediately; if you cannot patch right away, ensure set_workspace is called before any of the CODE_TOOLS are registered or exposed to agent/tool-calling flows, and audit deployment code for that ordering.
Is CVE-2026-56839 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-56839, increasing the risk of exploitation.
How to fix CVE-2026-56839?
No patch is currently available. Monitor vendor advisories for updates.
What is the CVSS score for CVE-2026-56839?
CVE-2026-56839 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.38%.
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application that exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace can therefore let prompt-influenced calls read and modify files outside the intended project directory, while explicitly configured workspaces remain effective. This vulnerability is fixed in 4.6.59.
Weaknesses (CWE)
CWE-200Exposure of Sensitive Information to an Unauthorized ActorCWE-200Exposure of Sensitive Information to an Unauthorized ActorCWE-22Improper Limitation of a Pathname to a Restricted DirectoryCWE-22Improper Limitation of a Pathname to a Restricted DirectoryCWE-863Incorrect AuthorizationCWE-863Incorrect AuthorizationCWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N