Vulnerability in praison (CVE-2026-44336, CVSS 9.6)

Summary

vulnerability in praison (CVE-2026-44336). Successful exploitation can lead to full system takeover. Exploitable via praisonai.rules.create.

Original description

The description as published by the source.

Summary

PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-handling tools by default — praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and praisonai.workflow.show. Each accepts a path or filename string from MCP tools/call arguments and joins it onto ~/.praison/rules/ (or, for workflow.show, accepts an absolute path) with no containment check. The JSON-RPC dispatcher passes params["arguments"] blind to each handler via **kwargs without validating against the advertised input schema.

By setting rule_name="../../" an attacker walks out of the rules directory and writes any file the running user can write. Dropping a Python .pth file into the user site-packages directory escalates this primitive to arbitrary code execution in any subsequent Python process the user spawns — the next praisonai CLI invocation, an IDE script run, the user's python REPL, or any background Python service. The same primitive is reachable from:

An MCP-connected LLM (Claude Desktop, Cursor, Continue.dev, Claude Code) whose context is poisoned by attacker-controlled web content / documents / emails — no operator click required beyond ordinary "ask the LLM to summarise this page" usage.
praisonai mcp serve --transport http-stream with no --api-key (default), reachable from any local process / DNS-rebound browser tab / container neighbour sharing loopback.
Stdio MCP from any prompt-injection…

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

PraisonAI's system had a flaw allowing attackers to write and execute unauthorized code by altering specific files. This issue is resolved in version 4.6.34, and it is recommended to update as soon as possible and check for any abnormal activities within your systems.

PraisonAI's MCP server (praisonai mcp serve) registers four file-handling tools by default and accepts arguments without validation from MCP tools/call. By passing "rule_name" as "../../<path>", attackers can write to arbitrary files outside the intended directory. Placing a Python .pth in the user site-packages leads to arbitrary code execution. Affected versions are prior to 4.6.34, and the issue is fixed in version 4.6.34. These path traversal vulnerabilities allow attackers to easily achieve remote code execution.

❓ What is the problem

PraisonAI MCP server's file-handling tools allow attackers to execute arbitrary code by manipulating file paths.

📍 Affected scope

MCP server tool endpoints: 'praisonai.rules.create', 'praisonai.rules.show', 'praisonai.rules.delete', 'praisonai.workflow.show'.

🔥 Severity

Critical severity with a CVSS v3 score of 9.6, indicating high potential for remote unauthorized access and code execution.

🔧 How to fix

Upgrade to PraisonAI version 4.6.34 to resolve the issues.

🛡️ Workaround

No specific workaround available, recommend immediate patching.

🔍 Detection

Monitor for unexpected .pth file writes in user site-packages directories and unusual file access patterns in ~/.praison/rules/.

Related past incidents Similar incidents extracted from past CVEs

CVE-2021-41773

This vulnerability involved an Apache HTTP server path traversal issue that also allowed for remote content exposure or execution.

CVE-2022-22965

Also known as Spring4Shell, a vulnerability enabling remote code execution via data binding in Spring Core.

CVE-2021-21972

An RCE vulnerability in VMware vCenter Server stemming from improper URL path handling, similar path traversal root causes.

If this happens at your company Expected impact per business scenario

📌 E-commerce platform hosting

The platform could be compromised through unauthorized code executions, leading to data breaches and financial losses.

📌 Internal IT system management

Sensitive internal systems could be exposed to unauthorized access or manipulation, affecting data integrity and operational continuity.

📌 Machine Learning Model Management

AI models could be manipulated, affecting outcomes and decision-making processes critical to business operations.

Recommended action

Urgently update PraisonAI to version 4.6.34 or later and monitor systems for signs of compromise.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'praison' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で praison を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

pip PraisonAI

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.34"}]}]

PyPI praisonai

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.34"}]}]

References

advisory nvd.nist.gov
package github.com
web github.com
web github.com