CVE-2026-57145: PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation
PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read files through edit and diff behavior or overwrite files accessible to the process, exposing secrets and enabling persistence or application tampering. This issue is fixed in 4.6.62.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.62
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
PraisonAI versions before 4.6.62 are affected where agents can invoke the multiedit tool and influence its filepath parameter. Exposure is limited by the filesystem permissions of the process running PraisonAI.
What does an attacker need to exploit it?
An attacker needs to influence an agent or LLM workflow so that it supplies a chosen filepath to multiedit. No authentication or user interaction is required according to the supplied severity vector.
What is the immediate remediation?
Upgrade PraisonAI to version 4.6.62, which fixes the issue. If an upgrade cannot be performed immediately, reduce or remove untrusted prompt influence over agents able to use multiedit and run the PraisonAI process with minimal filesystem permissions.
How can I determine whether an installation is affected?
Check the installed PraisonAI version and whether multiedit is available to prompt-influenced agent workflows. Any version earlier than 4.6.62 should be treated as affected.