CVE-2026-39305: 
Python vulnerability analysis and mitigation

CVE-2026-39305 is a path traversal (arbitrary file write) vulnerability in the Action Orchestrator module of PraisonAI, an AI agent framework. It affects all versions of the praisonai pip package up to and including 4.5.112, and was patched in version 4.5.113. The vulnerability was published by MervinPraison on April 5, 2026, added to the GitHub Advisory Database on April 6, 2026, and published by NVD on April 7, 2026. It carries a CVSS v3.1 base score of 9.0 (Critical) per the GitHub Advisory, though Feedly's estimate places it at 10.0 (GitHub Advisory, PraisonAI Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). In src/praisonai/praisonai/cli/features/action_orchestrator.py at lines 402, 409, and 423, the _apply_step method constructs file paths by directly concatenating the workspace directory with a user-supplied step.target string (target = workspace / step.target) without resolving or validating that the resulting absolute path remains within the workspace boundary. When processing FILE_CREATE or FILE_EDIT action types, an attacker can supply a step.target value containing ../ sequences (e.g., ../../../../../../../tmp/orchestrator_pwned.txt) to write files to arbitrary locations on the host filesystem. A public proof-of-concept Python snippet demonstrating this technique is included in the GitHub Security Advisory (GitHub Advisory, PraisonAI Advisory).

Successful exploitation allows an attacker or compromised AI agent to create or overwrite arbitrary files anywhere on the host filesystem that the PraisonAI process has write access to. This can lead to Remote Code Execution (RCE) by overwriting sensitive files such as ~/.ssh/authorized_keys, .bashrc, cron jobs, or dropping executable payloads, as well as system corruption by overwriting critical configuration or binary files. The scope is changed, meaning the impact extends beyond the PraisonAI process itself to the broader host system (GitHub Advisory, PraisonAI Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a standalone Python snippet that instantiates a malicious ActionStep object with a path traversal payload and passes it to the vulnerable _apply_step method (PraisonAI Advisory). No evidence of in-the-wild exploitation has been reported as of the time of publication. The EPSS score is approximately 0.076% (23rd percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been made (GitHub Advisory).

1. Identify a vulnerable target: Confirm the target system is running PraisonAI version 4.5.112 or earlier with the Action Orchestrator feature enabled (pip show praisonai).
2. Craft a malicious ActionStep payload: Construct a Python object with a path traversal string in the target field:

from praisonai.cli.features.action_orchestrator import ActionStep, ActionType, ActionStatus
step = ActionStep(
    id="test_traversal",
    action_type=ActionType.FILE_CREATE,
    description="Malicious file write",
    target="../../../../../../../tmp/orchestrator_pwned.txt",
    params={"content": "pwned"},
    status=ActionStatus.APPROVED
)

3. Inject via agent prompt (indirect): Alternatively, craft a malicious prompt that tricks the AI agent into generating an action plan containing the traversal payload as a FILE_CREATE or FILE_EDIT step target.
4. Trigger _apply_step: Cause the orchestrator to process the malicious step, either directly by calling _apply_step(step) or by having the agent execute the generated plan.
5. Achieve arbitrary file write: The orchestrator writes the attacker-controlled content to the traversed path (e.g., /tmp/orchestrator_pwned.txt). For RCE, target files such as ~/.ssh/authorized_keys (to add an SSH key), .bashrc, or a cron job file to execute commands on next login or scheduled run (GitHub Advisory, PraisonAI Advisory).

• File System: Unexpected files created or modified outside the configured PraisonAI workspace directory, particularly in /tmp/, ~/.ssh/, or home directories; modifications to ~/.ssh/authorized_keys, .bashrc, .profile, or cron files with timestamps correlating to orchestrator activity.
• Logs: PraisonAI orchestrator logs showing FILE_CREATE or FILE_EDIT action steps with target values containing ../ sequences; Python tracebacks or unexpected file write operations in application logs.
• Process: Unexpected processes spawned by the PraisonAI Python process following file writes (e.g., new SSH sessions, shell executions from modified .bashrc or cron jobs).
• Network: New inbound SSH connections from unknown IP addresses shortly after orchestrator activity, potentially indicating use of a dropped SSH authorized key (GitHub Advisory).

The vendor has released a patched version: PraisonAI 4.5.113 (pip install praisonai>=4.5.113), which addresses the path traversal flaw (GitHub Advisory, PraisonAI Advisory). If immediate upgrade is not possible, implement strict path validation in the _apply_step method using os.path.realpath() to resolve the final path and verify it is contained within the workspace directory before any file operation. Additionally, reject step.target values containing .. sequences or absolute paths as an input validation layer. Running the PraisonAI process under a least-privilege user account with restricted filesystem write permissions can limit the blast radius of exploitation.

The vulnerability was credited to researcher liyander, who reported it to the PraisonAI maintainers (GitHub Advisory). A post on Bluesky by cyberhub.blog referenced the CVE shortly after disclosure. No major vendor statements beyond the official advisory or significant media coverage have been identified at this time.