Path Traversal in PraisonAI Custom Command Templates

Executive Summary

This vulnerability in PraisonAI versions before 4.6.78 allows attackers to read files outside the intended workspace by exploiting improper validation of file path references in custom command templates.

Attackers can include path traversal sequences like @../outside_secret.txt or absolute file paths in project command files. When a user runs such a command, PraisonAI reads the referenced file and includes its contents in the prompt sent to the model or provider.

This happens because the interpolation code expands file references without verifying that they remain within the project directory, leading to a confidentiality issue.

The vulnerability requires user interaction, as the operator must run the malicious command for the file exfiltration to occur.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive files outside the workspace by including their contents in model prompts.

An attacker who can add or modify a repository can create malicious command templates that exfiltrate confidential or sensitive information readable by the process.

Because the vulnerability involves reading files outside the intended directory, it poses a confidentiality risk, potentially exposing secrets or private data.

The attack requires user interaction, meaning the operator must run the malicious command, which may limit the attack surface but still represents a significant risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from the ability of attackers to include path traversal sequences or absolute paths in custom command templates within PraisonAI, which then read files outside the workspace. Detection involves monitoring or auditing project command files for suspicious file path references such as '@../' or absolute paths that point outside the intended project directory.

Since the vulnerability requires user interaction to run malicious commands, detection can also include reviewing command execution logs for commands that reference external file paths or unusual file reads.

Specific commands to detect this vulnerability are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade PraisonAI to version 4.6.78 or later, where the vulnerability has been fixed by resolving file paths against the project root before reading them.

Until the upgrade can be applied, avoid running untrusted or modified project command templates that may contain path traversal sequences or absolute file paths.

Additionally, restrict write access to project command files to trusted users only, to prevent attackers from adding malicious command templates.

Useful 0 Not Useful 0