CVE-2026-57129

PraisonAI praisonaiagents before 1.6.59 contains a path traversal flaw (CWE-22) in MentionsParser._process_file_mention, which falls back from workspace-relative resolution to Path(file_path) without validating traversal sequences, symlinks, or workspace boundaries. An attacker triggers it by embedding a crafted file-mention value (e.g., an absolute path or '../' traversal) in prompt input that reaches the agent, whether from a chat user, a connected bot, or an automated workflow. Successful exploitation allows reading arbitrary files accessible to the agent process, including credentials, API keys, environment files, source code, and system configuration (CVSS 3.1: 7.5, network vector, no privileges or user interaction required, high confidentiality impact). Any deployment running praisonaiagents prior to 1.6.59 that processes prompts from untrusted or semi-trusted sources is affected. The issue is fixed in version 1.6.59; there is no known public PoC, no evidence of in-the-wild exploitation, and it is not listed in the CISA KEV catalog.

What to do: Upgrade praisonaiagents to version 1.6.59 or later as soon as possible. If upgrading is delayed, avoid passing untrusted prompt input into the agent and run the agent process in a container or under a minimal-privilege account so that secrets such as .env files, keys, and credentials are not readable. Review agent logs for file-mention patterns containing absolute paths or '../' sequences and rotate any credentials that were readable by the process.