CyberRota Analysis
AI-GeneratedThe vulnerability in PraisonAI affects the MentionsParser._process_file_mention function, which improperly handles file-mention values, allowing unauthorized access to arbitrary files within the process's environment. This could lead to exposure of sensitive information such as credentials, keys, and configuration files. Organizations using versions prior to 1.6.59 should prioritize patching this vulnerability to mitigate the risk of data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.