CVE-2026-56834 PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools. The implemented artifact tools do not enforce that the supplied artifactpath is an artifact created by the...

CVE-2026-56834

The PraisonAI multi-agent system (package praisonai) is vulnerable to arbitrary file read via its Dynamic Context Discovery artifact helper tools. Specifically, the artifact_head, artifact_tail, artifact_grep, and artifact_chunk functions in src/praisonai/praisonai/context/queue.py fail to enforc...