CVE-2026-56839

PraisonAI, an open-source multi-agent framework, fails to restrict file access in its CODE_TOOLS wrappers when no workspace has been configured: _workspace_root stays None and workspace=None is passed to read_file, search_replace, and apply_diff, which only enforce path containment when a truthy workspace is set. As a result, an application that exposes the code_read_file, code_search_replace, or code_apply_diff tools before calling set_workspace lets attacker-influenced prompts (e.g., via prompt injection) read and modify arbitrary files outside the intended project directory. This yields high confidentiality and integrity impact — arbitrary file disclosure and tampering on the host running the agent — though it requires the application to expose these tools and some user interaction or low privileges, per the CVSS 3.1 vector (7.3, high). Explicitly configured workspaces are unaffected; the flaw only bites deployments that never set a workspace. There is no evidence of exploitation and no public proof of concept.

What to do: Upgrade PraisonAI to 4.6.59 or later, which fixes the workspace enforcement gap. If you build applications on it, always call set_workspace before enabling code_read_file, code_search_replace, or code_apply_diff, and run agents under a dedicated low-privilege OS account with minimal filesystem access. Audit agent transcripts and file logs for any read/write operations targeting paths outside your intended project directory.