CVE-2026-57145

PraisonAI, an open-source multi-agent LLM framework, contains a path traversal flaw (CWE-22) in the multiedit tool (src/praisonai/praisonai/tools/multiedit.py) in versions before 4.6.62. The tool passes an LLM-controlled filepath parameter directly to open() for both reading and writing, with no traversal rejection, symlink resolution, workspace boundary, or protected-path checks. An attacker who can influence the agent's prompt (e.g., via prompt injection through task descriptions, retrieved documents, or untrusted user input) can direct the agent to read sensitive files via the edit/diff behavior or overwrite any file accessible to the process, exposing secrets such as API keys and enabling persistence or application tampering. Any deployment running PraisonAI prior to 4.6.62 that exposes the multiedit tool to agents processing untrusted content is affected; the flaw is rated critical (CVSS 3.1: 9.1). The issue is fixed in version 4.6.62, and there is no known public PoC or observed in-the-wild exploitation.

What to do: Upgrade PraisonAI to version 4.6.62 or later immediately. Until patched, disable or restrict the multiedit tool for agents that handle untrusted prompts or content, and run agent processes in a container or as a low-privilege user with minimal filesystem access. Review agent logs and tool-call history for suspicious filepaths (traversal sequences, absolute paths outside the workspace, symlink targets) and rotate any secrets (API keys, credentials) that files readable by the process may have contained.