CVE-2026-40117
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In PraisonAIAgents prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem via an unrestricted skill_path parameter. Unlike other functions, it enforces neither workspace boundary confinement nor critical-level approval.
Risk Assessment
An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt, leading to data leakage.
Recommendation
Update PraisonAIAgents to version 1.5.128 or later, which fixes this vulnerability.
Other vulnerabilities in PraisonAIAgents
See all- CVE-2026-57123Critical
In praisonaiagents prior to 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding.
- CVE-2026-57129High
In praisonaiagents prior to 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.
- CVE-2026-57126High
In praisonaiagents prior to 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.
- CVE-2026-40160Medium
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost, and the response content is returned to the agent and may appear in output visible to the attacker.
- CVE-2026-40152Medium
PraisonAIAgents prior to 1.5.128 contains a vulnerability in the list_files() tool in FileTools. The pattern parameter is passed directly to Path.glob() without validation, allowing relative path traversal to enumerate arbitrary files outside the workspace and obtain file metadata.
Original NVD description (English source)
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem by accepting an unrestricted skill_path parameter. Unlike file_tools.read_file which enforces workspace boundary confinement, and unlike run_skill_script which requires critical-level approval, read_skill_file has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt. This vulnerability is fixed in 1.5.128.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS