CVE-2026-56833
PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
Summary
PraisonAI's Dynamic Context module provides filesystem-backed history and
terminal-log storage. The SDK reference describes the module as providing:
- artifact storage for tool outputs, history, and terminal logs;
- history persistence with search; and
- terminal session logging.
The module also exports agent-callable tool factories:
- create_history_tools() returns history_search, history_tail, and
history_get.
- create_terminal_tools() returns terminal_tail, terminal_grep, and
terminal_commands.
Those tools accept run_id and agent_id arguments from the tool caller. The
underlying stores join those values into filesystem paths without rejecting
absolute paths or .. traversal:
history_dir = self.base_dir / run_id / "history"
return history_dir / f"{agent_id}.jsonl"
terminal_dir = self.base_dir / run_id / "terminal"
return terminal_dir / f"{agent_id}.log"
Because run_id can be an absolute path and agent_id can contain traversal,
a lower-trust prompt/user that can call these tools can read .jsonl and
.log files outside the configured Dynamic Context base directory.
Affected Product
- Repository: MervinPraison/PraisonAI
- Ecosystem: pip
- Package: praisonai
- Component: Dynamic Context history and terminal tools
- Current source paths:
- src/praisonai/praisonai/context/history_store.py
- src/praisonai/praisonai/context/terminal_logger.py
- Latest PyPI version validated: 4.6.58
- Current origin/main validated:
1ad58ca02975ff1398efeda694ea2ab78f20cf3e
- Current origin/main tag validated: v4.6.58
Suggested affected range:
pip:praisonai >= 3.8.1, <= 4.6.58
Representative local sweep:
- 3.8.1: vulnerable
- 4.0.0: vulnerable
- 4.5.113: vulnerable
- 4.6.33: vulnerable
- 4.6.34: vulnerable
- 4.6.40: vulnerable
- 4.6.50: vulnerable
- 4.6.58: vulnerable
Root Cause
HistoryStore._get_history_path() and TerminalLogger._get_log_path() treat
logical i
⚡ Watch CVE-2026-56833
Get an email if CVE-2026-56833 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-56833)