CVE-2026-55540

7.1 Élevée

Publiée le 25/08/2026 à 17:16 · Modifiée le 09/09/2026 à 23:07 · Analyse NVD reportée · Source : security-advisories@github.com

Description

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58.

Traduire en français

Produits concernés

MervinPraison PraisonAI

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.1 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L`

Faiblesses (CWE)

CWE-22

Références

https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories