CVE-2026-56833 — PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.

PYSEC-2026-3499 — PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

Affected: PyPI: praisonai

# PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

## Summary

PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The SDK reference describes the module as providing:

- artifact storage for tool outputs, history, and terminal logs; - history persistence with search; and - terminal session logging.

The module also exports agent-callable tool factories:

- `create_history_tools()` returns `history_search`, `history_tail`, and `history_get`. - `create_terminal_tools()` returns `terminal_tail`, `terminal_grep`, and `terminal_commands`.

Those tools accept `run_id` and `agent_id` arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or `..` traversal:

```python history_dir = self.base_dir / run_id / "history" return history_dir / f"{agent_id}.jsonl" ```

```python terminal_dir = self.base_dir / run_id / "terminal" return terminal_dir / f"{agent_id}.log" ```

Because `run_id` can be an absolute path and `agent_id` can contain traversal, a lower-trust prompt/user that can call these tools can read `.jsonl` and `.log` files outside the configured Dynamic Context base directory.

## Affected Product

- Repository: `MervinPraison/PraisonAI` - Ecosystem: `pip` - Package: `praisonai` - Component: Dynamic Context history and terminal tools - Current source paths: - `src/praisonai/praisonai/context/hist…

Most recent entries from all

CVE-2026-56833 — PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

PYSEC-2026-3499 — PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal