CVE-2026-40117

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem by accepting an unrestricted skill_path parameter. Unlike file_tools.read_file which enforces workspace boundary confinement, and unlike run_skill_script which requires critical-level approval, read_skill_file has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt. This vulnerability is fixed in 1.5.128.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-grrg-5cg9-58pf	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) PraisonAIAgents es un sistema de equipos multiagente. Antes de 1.5.128, read_skill_file() en skill_tools.py permite la lectura de archivos arbitrarios del sistema de archivos al aceptar un parámetro skill_path sin restricciones. A diferencia de file_tools.read_file, que aplica la contención de los límites del espacio de trabajo, y a diferencia de run_skill_script, que requiere aprobación de nivel crítico, read_skill_file no tiene ninguna de las dos protecciones. Un agente influenciado por inyección de prompt puede exfiltrar archivos sensibles sin activar ninguna solicitud de aprobación. Esta vulnerabilidad está corregida en 1.5.128.

Information

Published : 2026-04-09 22:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-40117

Mitre link : CVE-2026-40117

CVE.ORG link : CVE-2026-40117

JSON object : View

Products Affected

praison

praisonaiagents

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-40117", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40117", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T18:14:12.343930Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MervinPraison", "product": "PraisonAIAgents", "versions": [{"status": "affected", "version": "< 1.5.128"}]}]}], "published": "2026-04-09T22:16:35.447", "references": [{"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-grrg-5cg9-58pf", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem by accepting an unrestricted skill_path parameter. Unlike file_tools.read_file which enforces workspace boundary confinement, and unlike run_skill_script which requires critical-level approval, read_skill_file has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt. This vulnerability is fixed in 1.5.128."}, {"lang": "es", "value": "PraisonAIAgents es un sistema de equipos multiagente. Antes de 1.5.128, read_skill_file() en skill_tools.py permite la lectura de archivos arbitrarios del sistema de archivos al aceptar un par\u00e1metro skill_path sin restricciones. A diferencia de file_tools.read_file, que aplica la contenci\u00f3n de los l\u00edmites del espacio de trabajo, y a diferencia de run_skill_script, que requiere aprobaci\u00f3n de nivel cr\u00edtico, read_skill_file no tiene ninguna de las dos protecciones. Un agente influenciado por inyecci\u00f3n de prompt puede exfiltrar archivos sensibles sin activar ninguna solicitud de aprobaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 1.5.128."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1797C27-7EBC-4CEF-90B8-F84E8198632D", "versionEndExcluding": "1.5.128"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}