CVE-2026-56834: PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools(). The implemented artifact tools do not enforce that the supplied artifactpath is an artifact created by the configured store or that it lives under the configured artifact base directory. Instead, artifacthead, artifacttail, artifactgrep, and artifactchunk wrap the caller-supplied path directly into an ArtifactRef and then read it from the host filesystem. As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data. This issue has been patched in version 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
PraisonAI versions 3.8.1 through before 4.6.59 are affected when Dynamic Context Discovery exposes artifact helper tools through ctx.get_tools(). The impact is limited to files that the PraisonAI process can read on the host.
What does an attacker need to exploit it?
An attacker needs a way to influence arguments passed to the artifact helper tools, such as through a prompt, user input, or another tool caller. No authentication or user interaction is required according to the supplied severity vector.
Which operations can be abused to read host files?
The affected helpers are artifact_head, artifact_tail, artifact_grep, and artifact_chunk. They accept a caller-supplied artifact_path and read it directly rather than validating that it belongs to the configured artifact store or base directory.
What should be done if an immediate upgrade is not possible?
Prevent untrusted prompts, users, and tool callers from controlling artifact helper arguments, and avoid exposing the Dynamic Context Discovery artifact tools through ctx.get_tools(). Run PraisonAI with the minimum filesystem permissions needed to reduce the scope of readable data.
How can I determine whether my instance is affected?
Check whether the installed PraisonAI version is at least 3.8.1 and earlier than 4.6.59, and whether Dynamic Context Discovery makes artifact tools available via ctx.get_tools(). Upgrade to version 4.6.59 or later to obtain the patch.