CVE-2026-61432: PraisonAI: FastContext path traversal leaks host files

PraisonAI's FastContext agent tool — the code behind grep_search, glob_search, read_file, and list_directory — only prepends the configured workspace_path to relative paths and never rejects absolute paths or canonicalizes the joined path before checking containment, so a crafted tool argument (or a model-generated function call steered by attacker-controlled input) can walk straight out of the sandbox and read files anywhere on the host. This is a confidentiality-only bug (CVSS 5.7, C:H/I:N/A:N) reachable with only low privileges and some user interaction (PR:L, UI:R) — including via indirect prompt injection if untrusted content the agent ingests can influence which tool arguments get generated. There is no sign of active exploitation: it's absent from CISA KEV, EPSS is unscored, no public exploit or Nuclei template exists, and downstream dependent counts and package risk score aren't available, so today's likelihood is theoretical rather than observed. The bug class itself is high-value to attackers, though — unsandboxed file-read tools reachable from LLM-directed input are a proven path to harvesting .env files, SSH keys, and cloud credentials from agent hosts. Upgrade praisonaiagents to 1.6.78 or later now, and in the interim reject absolute paths and canonicalize (realpath) every FastContext tool argument against workspace_path, run the agent process with least-privilege filesystem access, and alert on any grep_search/read_file/list_directory/glob_search call whose resolved path lands outside the workspace.

Proof-of-concept exploit code is publicly available for CVE-2026-61432, increasing the risk of exploitation.

1) Patch: upgrade praisonaiagents to 1.6.78 or later immediately — this is the primary and complete fix per the vendor advisory. 2) If patching is delayed, add an application-layer guard: reject any FastContext tool argument that is an absolute path or contains '../' sequences, and canonicalize every resolved path (os.path.realpath) before comparing it against workspace_path with a strict prefix check. 3) Defense in depth: run agent processes with least-privilege OS permissions — dedicated non-root user, read-only mounts for anything outside the workspace, no access to credential files or other tenants' directories, and container/chroot isolation where feasible. 4) Detection: log every grep_search/glob_search/read_file/list_directory call with its resolved (not raw) path, and alert on any resolution outside workspace_path or on arguments containing leading '/' or '../'. 5) If FastContext is exposed to untrusted retrieved content (indirect prompt injection surface), treat tool-argument generation from that content as untrusted input regardless of patch status.

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, coding/dev agent tool integrations, multi-tenant AI agent deployments, local file system context retrieval.

CVE-2026-61432 has a CVSS v3.1 base score of 5.7 (MEDIUM). The EPSS exploitation probability is 0.34%.