Lucene search
+L

6 matches found

OSV
OSV
added 2026/07/23 11:41 a.m.8 views

PYSEC-2026-3527 PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal

Summary The MentionsParser in src/praisonai-agents/praisonaiagents/tools/mentions.py processes @file: mentions in agent prompts by reading arbitrary files from the filesystem. When a file path is not found relative to the workspace, the parser falls back to using the path as an absolute path...

7.5CVSS5.7AI score
SaveExploits0References5
Snyk
Snyk
added 2026/06/18 1:57 p.m.8 views

Directory Traversal

Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Directory Traversal via the MentionsParser process when handling @file: mentions in agent prompts. An attacker can access arbitrary files on...

8.7CVSS6.5AI score
SaveExploits0References2
OSV
OSV
added 2026/06/18 1:57 p.m.7 views

GHSA-2RCG-MM5H-XCHX PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal

Summary The MentionsParser in src/praisonai-agents/praisonaiagents/tools/mentions.py processes @file: mentions in agent prompts by reading arbitrary files from the filesystem. When a file path is not found relative to the workspace, the parser falls back to using the path as an absolute path...

7.5CVSS5.7AI score
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/05/29 10:29 p.m.28 views

PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

Summary PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL...

5.5CVSS5.9AI score0.00129EPSS
SaveExploits0References2Affected Software2
OSV
OSV
added 2026/05/29 10:29 p.m.9 views

GHSA-5CXW-77WG-JRF3 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

Summary PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL...

5.5CVSS5.9AI score0.00129EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/05/29 12:0 a.m.22 views

PT-2026-45054

Name of the Vulnerable Software and Affected Versions PraisonAI affected versions not specified Description The direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution. The MentionsParser.process function handles these mentions by performing a direct HTTP...

5.5CVSS6.1AI score0.00129EPSS
SaveExploits0References11
Rows per page
Query Builder