AI Threat AlertCVE-2026-57129: PraisonAI: path traversal exposes arbitrary files
HIGHPoC AVAILABLECISA: TRACK*A path traversal flaw in PraisonAI's agent framework lets any prompt-driven "file mention" reference (e.g. "@../../.env") bypass workspace boundary checks and read arbitrary files on the host, including credentials, API keys, .env files, source code, and system configuration. The bug requires no authentication and no user interaction (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N), meaning any user, bot, or automated workflow able to send a message to a PraisonAI-based agent can trigger it directly over the network. There is no evidence of active exploitation (not in CISA KEV, no public PoC or Nuclei template, EPSS unavailable), but the attack requires no special skill and PraisonAI's growing adoption as a multi-agent orchestration layer makes this a realistic credential-theft vector for any deployment that exposes agent chat/API surfaces to untrusted input. Upgrade to praisonaiagents 1.6.59 immediately; until patched, restrict or sandbox filesystem access for agent processes and treat any environment where PraisonAI ingests external or bot-supplied prompts as compromised for secrets purposes. Audit logs for file-mention values containing "../", absolute paths, or symlink indicators as a detection signal.
What is the risk?
High risk for any deployment where PraisonAI agents accept prompt input from users, external bots, or automated workflows. The vulnerability is trivially exploitable (low complexity, no privileges, no user interaction) and has full confidentiality impact with no integrity or availability impact — it is a pure information-disclosure primitive but one capable of exfiltrating the exact secrets (API keys, cloud credentials, .env files) that enable further compromise. Absence of KEV listing, EPSS score, or public exploit code lowers the immediate mass-exploitation likelihood, but the trivial exploitation path and network-reachable attack surface mean risk should be treated as high wherever agent endpoints are internet- or partner-facing.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | — | No patch |
| PraisonAI Agents | pip | — | No patch |
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade praisonaiagents to 1.6.59 or later immediately — this is the primary and only complete fix. 2) Until patched, disable or restrict the file-mention feature for any agent that accepts input from untrusted users, bots, or external workflows. 3) Run agent processes with least-privilege filesystem permissions and in a sandboxed/containerized environment so even a successful traversal cannot reach secrets outside the container (e.g., avoid mounting host .env/credential files into agent containers). 4) Rotate any credentials or API keys that may have been accessible to affected agent processes prior to patching. 5) Detection: monitor file-mention inputs and agent file-access logs for path traversal patterns ("../", absolute paths, symlink targets) and alert on any file-mention resolution outside the expected workspace root.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-57129?
A path traversal flaw in PraisonAI's agent framework lets any prompt-driven "file mention" reference (e.g. "@../../.env") bypass workspace boundary checks and read arbitrary files on the host, including credentials, API keys, .env files, source code, and system configuration. The bug requires no authentication and no user interaction (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N), meaning any user, bot, or automated workflow able to send a message to a PraisonAI-based agent can trigger it directly over the network. There is no evidence of active exploitation (not in CISA KEV, no public PoC or Nuclei template, EPSS unavailable), but the attack requires no special skill and PraisonAI's growing adoption as a multi-agent orchestration layer makes this a realistic credential-theft vector for any deployment that exposes agent chat/API surfaces to untrusted input. Upgrade to praisonaiagents 1.6.59 immediately; until patched, restrict or sandbox filesystem access for agent processes and treat any environment where PraisonAI ingests external or bot-supplied prompts as compromised for secrets purposes. Audit logs for file-mention values containing "../", absolute paths, or symlink indicators as a detection signal.
Is CVE-2026-57129 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-57129, increasing the risk of exploitation.
How to fix CVE-2026-57129?
1) Upgrade praisonaiagents to 1.6.59 or later immediately — this is the primary and only complete fix. 2) Until patched, disable or restrict the file-mention feature for any agent that accepts input from untrusted users, bots, or external workflows. 3) Run agent processes with least-privilege filesystem permissions and in a sandboxed/containerized environment so even a successful traversal cannot reach secrets outside the container (e.g., avoid mounting host .env/credential files into agent containers). 4) Rotate any credentials or API keys that may have been accessible to affected agent processes prior to patching. 5) Detection: monitor file-mention inputs and agent file-access logs for path traversal patterns ("../", absolute paths, symlink targets) and alert on any file-mention resolution outside the expected workspace root.
What systems are affected by CVE-2026-57129?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI-driven automation/workflow pipelines.
What is the CVSS score for CVE-2026-57129?
CVE-2026-57129 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.53%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0037Data from Local SystemAML.T0053AI Agent Tool InvocationAML.T0055Unsecured CredentialsAML.T0093Prompt Infiltration via Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.
Exploitation Scenario
An organization deploys a PraisonAI-based multi-agent assistant that lets team members reference project files in chat via a "@filename" mention syntax, with the agent also reachable by an internal Slack bot integration. An attacker with only message-sending access (a low-privilege employee, a compromised bot account, or an external party interacting with a public-facing agent workflow) sends a message containing a crafted mention such as "@../../../.env" or "@/etc/passwd". MentionsParser._process_file_mention fails to validate the resolved path stays within the workspace, falls back to raw Path(file_path) resolution, and returns the file's contents in the agent's response. The attacker harvests API keys and cloud credentials from the returned .env contents and uses them to pivot into connected services — all without authentication beyond whatever minimal access was needed to message the agent.
Weaknesses (CWE)
CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimaryCWE-22Improper Limitation of a Pathname to a Restricted DirectoryCWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3493810.0praisonaiagents: sandbox bypass enables full host RCE
Same package: praisonaiagentsCVE-2026-3988810.0praisonaiagents: sandbox escape enables host RCE
Same package: praisonaiagentsCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiagentsCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonaiagentsGHSA-vc46-vw85-3wvm9.8PraisonAI: RCE via malicious workflow YAML execution
Same package: praisonaiagents