CVE-2026-57145criticalAgent hijacking2026-09-14

CVE-2026-57145: PraisonAI's multiedit tool lets the model read and overwrite any file

PraisonAI's multiedit agent tool passed the model-controlled file path straight to open() for reading and writing, with no traversal check, workspace boundary, symlink resolution or protected-path guard. Anyone who can influence an agent's tool arguments, for example through prompt injection or a malicious YAML workflow, can read secrets like SSH keys and overwrite files.

01.

What it is

src/praisonai/praisonai/tools/multiedit.py uses the filepath argument directly for reading and writing, unlike sibling tools in the same codebase that reject '..', resolve symlinks and enforce a workspace boundary.

The tool is exported through the PraisonAI CLI tools registry, so agents can call it. The advisory gives /etc/shadow, ~/.ssh/id_rsa and ~/.aws/credentials as examples of readable files, and overwriting files allows persistence or tampering with the application.

02.

How to check

Affected: praisonai (PyPI) before the fixed release. The GitHub advisory lists 4.6.61 as patched; NVD says it is fixed in 4.6.62.
Check whether your agents have the multiedit tool enabled and process input you don't control.

03.

How to fix

Upgrade praisonai to 4.6.62 or later.
Run agents with file tools in a sandbox or container with no access to real credentials.

pip show praisonai | grep -i version

04.

Sources

More advisories for this tool