AI Threat Alert
CVE-2026-61432: PraisonAI: FastContext path traversal leaks host files
MEDIUM PoC AVAILABLE CISA: TRACK*PraisonAI's FastContext agent tool — the code behind grep_search, glob_search, read_file, and list_directory — only prepends the configured workspace_path to relative paths and never rejects absolute paths or canonicalizes the joined path before checking containment, so a crafted tool argument (or a model-generated function call steered by attacker-controlled input) can walk straight out of the sandbox and read files anywhere on the host. This is a confidentiality-only bug (CVSS 5.7, C:H/I:N/A:N) reachable with only low privileges and some user interaction (PR:L, UI:R) — including via indirect prompt injection if untrusted content the agent ingests can influence which tool arguments get generated. There is no sign of active exploitation: it's absent from CISA KEV, EPSS is unscored, no public exploit or Nuclei template exists, and downstream dependent counts and package risk score aren't available, so today's likelihood is theoretical rather than observed. The bug class itself is high-value to attackers, though — unsandboxed file-read tools reachable from LLM-directed input are a proven path to harvesting .env files, SSH keys, and cloud credentials from agent hosts. Upgrade praisonaiagents to 1.6.78 or later now, and in the interim reject absolute paths and canonicalize (realpath) every FastContext tool argument against workspace_path, run the agent process with least-privilege filesystem access, and alert on any grep_search/read_file/list_directory/glob_search call whose resolved path lands outside the workspace.
What is the risk?
Medium severity (CVSS 5.7) driven entirely by confidentiality impact — no integrity or availability loss. Exploitability is moderate: attack complexity is low and no special privileges beyond low-level access to the agent are needed, but user interaction is required, meaning either a low-privileged user must directly prompt the agent to invoke a FastContext tool with a malicious path, or an attacker must get malicious content into something the agent processes (indirect prompt injection) that causes the model to generate the traversal call itself. No exploitation signals exist yet: not in CISA KEV, no EPSS score, no public exploit code, and no Nuclei template — so real-world exploitation likelihood is currently unproven rather than confirmed low. Package-level context (downstream dependents, OpenSSF Scorecard, GitHub activity) is unavailable, which limits blast-radius estimation but should not be read as evidence the exposure is small; PraisonAI is an actively used agent framework and any deployment exposing FastContext to untrusted prompts or untrusted retrieved content is exposed.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI Agents | pip | — | No patch |
Do you use PraisonAI Agents? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
1) Patch: upgrade praisonaiagents to 1.6.78 or later immediately — this is the primary and complete fix per the vendor advisory. 2) If patching is delayed, add an application-layer guard: reject any FastContext tool argument that is an absolute path or contains '../' sequences, and canonicalize every resolved path (os.path.realpath) before comparing it against workspace_path with a strict prefix check. 3) Defense in depth: run agent processes with least-privilege OS permissions — dedicated non-root user, read-only mounts for anything outside the workspace, no access to credential files or other tenants' directories, and container/chroot isolation where feasible. 4) Detection: log every grep_search/glob_search/read_file/list_directory call with its resolved (not raw) path, and alert on any resolution outside workspace_path or on arguments containing leading '/' or '../'. 5) If FastContext is exposed to untrusted retrieved content (indirect prompt injection surface), treat tool-argument generation from that content as untrusted input regardless of patch status.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-61432?
PraisonAI's FastContext agent tool — the code behind grep_search, glob_search, read_file, and list_directory — only prepends the configured workspace_path to relative paths and never rejects absolute paths or canonicalizes the joined path before checking containment, so a crafted tool argument (or a model-generated function call steered by attacker-controlled input) can walk straight out of the sandbox and read files anywhere on the host. This is a confidentiality-only bug (CVSS 5.7, C:H/I:N/A:N) reachable with only low privileges and some user interaction (PR:L, UI:R) — including via indirect prompt injection if untrusted content the agent ingests can influence which tool arguments get generated. There is no sign of active exploitation: it's absent from CISA KEV, EPSS is unscored, no public exploit or Nuclei template exists, and downstream dependent counts and package risk score aren't available, so today's likelihood is theoretical rather than observed. The bug class itself is high-value to attackers, though — unsandboxed file-read tools reachable from LLM-directed input are a proven path to harvesting .env files, SSH keys, and cloud credentials from agent hosts. Upgrade praisonaiagents to 1.6.78 or later now, and in the interim reject absolute paths and canonicalize (realpath) every FastContext tool argument against workspace_path, run the agent process with least-privilege filesystem access, and alert on any grep_search/read_file/list_directory/glob_search call whose resolved path lands outside the workspace.
Is CVE-2026-61432 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-61432, increasing the risk of exploitation.
How to fix CVE-2026-61432?
1) Patch: upgrade praisonaiagents to 1.6.78 or later immediately — this is the primary and complete fix per the vendor advisory. 2) If patching is delayed, add an application-layer guard: reject any FastContext tool argument that is an absolute path or contains '../' sequences, and canonicalize every resolved path (os.path.realpath) before comparing it against workspace_path with a strict prefix check. 3) Defense in depth: run agent processes with least-privilege OS permissions — dedicated non-root user, read-only mounts for anything outside the workspace, no access to credential files or other tenants' directories, and container/chroot isolation where feasible. 4) Detection: log every grep_search/glob_search/read_file/list_directory call with its resolved (not raw) path, and alert on any resolution outside workspace_path or on arguments containing leading '/' or '../'. 5) If FastContext is exposed to untrusted retrieved content (indirect prompt injection surface), treat tool-argument generation from that content as untrusted input regardless of patch status.
What systems are affected by CVE-2026-61432?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, coding/dev agent tool integrations, multi-tenant AI agent deployments, local file system context retrieval.
What is the CVSS score for CVE-2026-61432?
CVE-2026-61432 has a CVSS v3.1 base score of 5.7 (MEDIUM). The EPSS exploitation probability is 0.41%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0037 Data from Local System AML.T0051.001 Indirect AML.T0053 AI Agent Tool Invocation AML.T0086 Exfiltration via AI Agent Tool Invocation Compliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.
Exploitation Scenario
An organization deploys a PraisonAI-based coding assistant scoped to a project's workspace_path, expecting FastContext's read_file/grep_search/glob_search/list_directory tools to stay contained there. A low-privileged user (or an attacker who plants a malicious instruction inside a file, issue, or web page the agent is asked to review) crafts a request that causes the model to call read_file with an absolute path like /etc/passwd or workspace-relative traversal like '../../.env', or grep_search across '/home/app/.ssh/'. Because FastContextAgent.execute_tool() only strips the workspace prefix for already-relative paths and never canonicalizes or rejects absolute/traversal paths, the tool call succeeds outside the intended sandbox. The file contents are returned to the caller and also injected into the LLM's context, so the attacker either receives the leaked secrets directly in the tool response or gets the model to restate/summarize them in its next reply — yielding credentials, API keys, or proprietary source outside the authorized project scope.
Weaknesses (CWE)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N References
Timeline
Related Vulnerabilities
CVE-2026-34938 10.0 praisonaiagents: sandbox bypass enables full host RCE
Same package: praisonaiagents CVE-2026-39888 10.0 praisonaiagents: sandbox escape enables host RCE
Same package: praisonaiagents CVE-2026-47392 9.9 praisonaiagents: RCE via Python sandbox bypass
Same package: praisonaiagents GHSA-vc46-vw85-3wvm 9.8 PraisonAI: RCE via malicious workflow YAML execution
Same package: praisonaiagents CVE-2026-47391 9.8 PraisonAI: Unauth RCE via A2A eval injection
Same package: praisonaiagents