CVE-2026-57129: PraisonAI path traversal exposes

CISO Take

A path traversal flaw in PraisonAI's agent framework lets any prompt-driven "file mention" reference (e.g. "@../../.env") bypass workspace boundary checks and read arbitrary files on the host, including credentials, API keys, .env files, source code, and system configuration. The bug requires no authentication and no user interaction (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N), meaning any user, bot, or automated workflow able to send a message to a PraisonAI-based agent can trigger it directly over the network. There is no evidence of active exploitation (not in CISA KEV, no public PoC or Nuclei template, EPSS unavailable), but the attack requires no special skill and PraisonAI's growing adoption as a multi-agent orchestration layer makes this a realistic credential-theft vector for any deployment that exposes agent chat/API surfaces to untrusted input. Upgrade to praisonaiagents 1.6.59 immediately; until patched, restrict or sandbox filesystem access for agent processes and treat any environment where PraisonAI ingests external or bot-supplied prompts as compromised for secrets purposes. Audit logs for file-mention values containing "../", absolute paths, or symlink indicators as a detection signal.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk for any deployment where PraisonAI agents accept prompt input from users, external bots, or automated workflows. The vulnerability is trivially exploitable (low complexity, no privileges, no user interaction) and has full confidentiality impact with no integrity or availability impact — it is a pure information-disclosure primitive but one capable of exfiltrating the exact secrets (API keys, cloud credentials, .env files) that enable further compromise. Absence of KEV listing, EPSS score, or public exploit code lowers the immediate mass-exploitation likelihood, but the trivial exploitation path and network-reachable attack surface mean risk should be treated as high wherever agent endpoints are internet- or partner-facing.

How does the attack unfold?

Initial Access

Attacker sends a crafted prompt or message containing a malicious file-mention value (e.g., '@../../.env') to a PraisonAI agent reachable over the network with no authentication.

AML.T0093

Exploitation

MentionsParser._process_file_mention falls back to unvalidated Path(file_path) resolution, allowing the traversal sequence to escape the intended workspace directory.

AML.T0053

Collection

The agent reads the targeted file — credentials, environment files, SSH keys, or source code — from anywhere accessible to the process.

AML.T0037

Impact

The file's contents are returned to the attacker in the agent's response, exposing secrets that can enable account takeover or lateral movement into connected systems.

AML.T0057

Initial Access

Attacker sends a crafted prompt or message containing a malicious file-mention value (e.g., '@../../.env') to a PraisonAI agent reachable over the network with no authentication.

AML.T0093

Exploitation

MentionsParser._process_file_mention falls back to unvalidated Path(file_path) resolution, allowing the traversal sequence to escape the intended workspace directory.

AML.T0053

Collection

The agent reads the targeted file — credentials, environment files, SSH keys, or source code — from anywhere accessible to the process.

AML.T0037

Impact

The file's contents are returned to the attacker in the agent's response, exposing secrets that can enable account takeover or lateral movement into connected systems.

AML.T0057

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
PraisonAI Agents	pip	—	No patch
20 dependents 59% patched ~6d to patch Full package profile →

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

1) Upgrade praisonaiagents to 1.6.59 or later immediately — this is the primary and only complete fix. 2) Until patched, disable or restrict the file-mention feature for any agent that accepts input from untrusted users, bots, or external workflows. 3) Run agent processes with least-privilege filesystem permissions and in a sandboxed/containerized environment so even a successful traversal cannot reach secrets outside the container (e.g., avoid mounting host .env/credential files into agent containers). 4) Rotate any credentials or API keys that may have been accessible to affected agent processes prior to patching. 5) Detection: monitor file-mention inputs and agent file-access logs for path traversal patterns ("../", absolute paths, symlink targets) and alert on any file-mention resolution outside the expected workspace root.

How is it classified?

Data Leakage Privacy Violation Agent Framework AML.T0037 - Data from Local System AML.T0053 - AI Agent Tool Invocation AML.T0055 - Unsecured Credentials AML.T0093 - Prompt Infiltration via Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-57129?

A path traversal flaw in PraisonAI's agent framework lets any prompt-driven "file mention" reference (e.g. "@../../.env") bypass workspace boundary checks and read arbitrary files on the host, including credentials, API keys, .env files, source code, and system configuration. The bug requires no authentication and no user interaction (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N), meaning any user, bot, or automated workflow able to send a message to a PraisonAI-based agent can trigger it directly over the network. There is no evidence of active exploitation (not in CISA KEV, no public PoC or Nuclei template, EPSS unavailable), but the attack requires no special skill and PraisonAI's growing adoption as a multi-agent orchestration layer makes this a realistic credential-theft vector for any deployment that exposes agent chat/API surfaces to untrusted input. Upgrade to praisonaiagents 1.6.59 immediately; until patched, restrict or sandbox filesystem access for agent processes and treat any environment where PraisonAI ingests external or bot-supplied prompts as compromised for secrets purposes. Audit logs for file-mention values containing "../", absolute paths, or symlink indicators as a detection signal.

Is CVE-2026-57129 actively exploited?

No confirmed active exploitation of CVE-2026-57129 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57129?

1) Upgrade praisonaiagents to 1.6.59 or later immediately — this is the primary and only complete fix. 2) Until patched, disable or restrict the file-mention feature for any agent that accepts input from untrusted users, bots, or external workflows. 3) Run agent processes with least-privilege filesystem permissions and in a sandboxed/containerized environment so even a successful traversal cannot reach secrets outside the container (e.g., avoid mounting host .env/credential files into agent containers). 4) Rotate any credentials or API keys that may have been accessible to affected agent processes prior to patching. 5) Detection: monitor file-mention inputs and agent file-access logs for path traversal patterns ("../", absolute paths, symlink targets) and alert on any file-mention resolution outside the expected workspace root.

What systems are affected by CVE-2026-57129?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI-driven automation/workflow pipelines.

What is the CVSS score for CVE-2026-57129?

CVE-2026-57129 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationAI-driven automation/workflow pipelines

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0053 AI Agent Tool Invocation

AML.T0055 Unsecured Credentials

AML.T0093 Prompt Infiltration via Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.

Exploitation Scenario

An organization deploys a PraisonAI-based multi-agent assistant that lets team members reference project files in chat via a "@filename" mention syntax, with the agent also reachable by an internal Slack bot integration. An attacker with only message-sending access (a low-privilege employee, a compromised bot account, or an external party interacting with a public-facing agent workflow) sends a message containing a crafted mention such as "@../../../.env" or "@/etc/passwd". MentionsParser._process_file_mention fails to validate the resolved path stays within the workspace, falls back to raw Path(file_path) resolution, and returns the file's contents in the agent's response. The attacker harvests API keys and cloud credentials from the returned .env contents and uses them to pivot into connected services — all without authentication beyond whatever minimal access was needed to message the agent.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.