CVE-2026-56839: PraisonAI Code agent tools fail open without a workspace boundary
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODETOOLS wrappers keep workspaceroot as None and pass workspace=None to readfile, searchreplace, and applydiff helpers that enforce path containment only for a truthy workspace. An application that exposes codereadfile, codesearchreplace, or codeapplydiff before setworkspace can therefore let prompt-influenced calls read and modify files outside the intended project directory, while explicitly configured workspaces remain effective. This vulnerability is fixed in 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59 - Compensating control
Ensure code_read_file, code_search_replace, and code_apply_diff are not accessible without an explicitly configured workspace boundary, since the vulnerability described occurs when wrappers pass workspace=None and _workspace_root is None.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using PraisonAI Code agent tools before 4.6.59 are exposed if they make code_read_file, code_search_replace, or code_apply_diff available before calling set_workspace. Deployments with an explicitly configured workspace retain the intended path-containment enforcement.
What does an attacker need to exploit this?
An attacker needs to influence calls to the affected code tool wrappers while no workspace has been set. User interaction is required according to the CVSS vector, and the attacker must have low-level privileges.
What can happen if exploitation succeeds?
Affected calls can read files outside the intended project directory and can modify files through search-and-replace or diff application. The reported impact includes high confidentiality and integrity impact, with no availability impact.
What should teams do if they cannot immediately upgrade?
Ensure set_workspace is called with the intended project directory before exposing or invoking any affected code tools. This enables the workspace containment checks that are bypassed when the workspace is unset.
How can teams determine whether they are affected?
Check whether the installed PraisonAI version is earlier than 4.6.59, then review initialization order for code_read_file, code_search_replace, and code_apply_diff. A deployment is affected when those tools can be reached while _workspace_root remains unset or workspace is passed as None.