File Access Vulnerability in PraisonAI by Mervin Praison

CVE-2026-57129

What is CVE-2026-57129?

The vulnerability exists in PraisonAI's MentionsParser._process_file_mention function, which does not properly validate file-mention values. As a result, it allows for the fallback from a workspace-relative resolution to a direct file path without necessary checks against traversal, symlinks, or workspace boundaries. This flaw can potentially allow attackers to read arbitrary files accessible to the process, including sensitive information such as credentials, keys, environment files, source code, and system configuration, thus exposing critical data. An update to version 1.6.59 has remedied this issue.

References