Unauthorized File Access in PraisonAI by Mervin

CVE-2026-57119

What is CVE-2026-57119?

PraisonAI, developed by Mervin, includes a vulnerability where the unauthenticated Jobs API allows remote callers to submit absolute or traversing file paths. This could lead to the unintended execution of files accessible to the service account, resulting in the exposure of critical information such as credentials, keys, and environment variables. The issue has been addressed in version 4.6.59, which implements proper workspace allowance checks to prevent unauthorized file access.

References