https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-06T18:31:55.341905+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-56839 CVE-2026-56839 — PraisonAI Code agent tools fail open without a workspace boundary 2026-10-06T18:31:55.343216+00:00

Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application that exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace can therefore let prompt-influenced calls read and modify files outside the intended project directory, while explicitly configured workspaces remain effective. This vulnerability is fixed in 4.6.59.

 https://db.gcve.eu/vuln/pysec-2026-3512 PYSEC-2026-3512 — PraisonAI Code agent tools fail open without a workspace boundary 2026-10-06T18:31:55.343285+00:00

Affected: PyPI: praisonai

# PraisonAI Code agent tools fail open without a workspace boundary

## Summary

PraisonAI Code's agent-compatible `CODE_TOOLS` wrappers keep a global workspace root initialized to `None`. If an application uses `CODE_TOOLS`, `code_read_file`, `code_search_replace`, or `code_apply_diff` before calling `set_workspace()`, the wrappers pass `workspace=None` into lower-level helpers that only enforce path containment when a workspace is truthy. Absolute paths outside the intended project workspace are then read and modified.

The official examples correctly call `set_workspace()` before `CODE_TOOLS`, and this report does not claim configured workspaces are ineffective. The issue is the fail-open default. PraisonAI's security documentation describes workspace boundaries as the path-traversal protection mechanism, and the already-published Python API arbitrary file write advisory (`GHSA-hvhp-v2gc-268q`) was fixed by defaulting an unset workspace to `os.getcwd()`. The adjacent read and edit paths reached through `CODE_TOOLS` still fail open.

## Affected Components

- Package: `praisonai` - Current upstream main tested: `2f9677abb2ea68eab864ee8b6a828fd0141612e1` - Latest tested release: `v4.6.57` - Primary files: - `src/praisonai/praisonai/code/agent_tools.py` - `src/praisonai/praisonai/code/tools/read_file.py` - `src/praisonai/praisonai/code/tools/search_replace.py` - `src/praisonai/praisonai/code/tools/apply_diff.py`

## Root Cause

`agent_tools.py` initializes `_workspac…