PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs APIGHSA-p4pj-vh7h-6cqh
HIGHGHSA-p4pj-vh7h-6cqh is a high-severity (CVSS 7.5) Path Traversal vulnerability in praisonai. A fix is available for praisonai — see the affected versions and patch details below.
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for GHSA-p4pj-vh7h-6cqh.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-p4pj-vh7h-6cqh by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 397,508 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
praisonaiReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
An unauthenticated attacker can read arbitrary files on the server by supplying an absolute filesystem path in the agent_file field of the Jobs API. The field has no path validation, no allowlist, and no authentication is required to submit jobs.
Details
The agent_file field in JobSubmitRequest accepts any filesystem path with no validation:
# src/praisonai/praisonai/jobs/models.py:29
agent_file: Optional[str] = Field(None, description="Path to agents.yaml file")
# NO path validator, NO allowlist
The executor reads the file directly:
# src/praisonai/praisonai/jobs/executor.py:221
agent_file = job.agent_file or "agents.yaml"
# passed directly to yaml.safe_load(open(agent_file))
Proof of Concept
curl -X POST http://:8005/api/v1/runs \
-H "Content-Type: application/json" \
-d '{"prompt": "run", "agent_file": "/etc/passwd"}'
Server responds with contents of /etc/passwd.
Other exploitable paths:
/proc/1/environ— environment variables, API keys/home//.ssh/id_rsa— SSH private keys/app/.env— application secrets
Impact
Any unauthenticated attacker with network access to port 8005 can read any file accessible to the server process, including credentials, private keys, and environment variables.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | praisonai | all versions | 4.6.59pip install --upgrade 'praisonai==4.6.59' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for praisonai, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update praisonai to 4.6.59 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p4pj-vh7h-6cqh is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
Frequently Asked Questions
Is GHSA-p4pj-vh7h-6cqh in your dependencies?
Find it across PyPI, including transitive dependencies.