CVE-2026-56833High· 7.5▾ TwilightPraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.
PraisonAI >= 3.8.1, < 4.6.59Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
praisonai >= 3.8.1, < 4.6.59Patched in:
praisonai 4.6.59Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56834High· 7.5PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
CVE-2026-56839High· 7.3PraisonAI is a multi-agent teams system
CVE-2026-57119High· 7.5PraisonAI is a multi-agent teams system
CVE-2026-57146High· 7.5PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
CVE-2026-57113High· 8.1PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
CVE-2026-57116Critical· 9.8PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation