File Reading Vulnerability in PraisonAI Agents by Mervin Praison
CVE-2026-40117

6.2MEDIUM

Key Information:

Vendor

Mervinpraison

Status
Praisonaiagents
Vendor
CVE Published:
9 April 2026

What is CVE-2026-40117?

PraisonAIAgents, a system for multi-agent teams, contains a significant vulnerability in the read_skill_file() function within skill_tools.py, allowing unauthorized access to arbitrary files on the filesystem. This occurs due to the unrestricted skill_path parameter, which lacks the necessary security checks found in other file-handling functions. As a result, an attacker can exploit prompt injection techniques to exfiltrate sensitive information without triggering any approval alerts, posing serious security risks. The issue has been addressed in version 1.5.128.

Affected Version(s)

PraisonAIAgents < 1.5.128

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.