PraisonAIAgents is a multi-agent system where the read_skill_file() function prior to version 1.5.128 accepts an unrestricted skill_path parameter, permitting arbitrary file reads from the filesystem. Unlike other functions such as file_tools.read_file or run_skill_script, read_skill_file lacks workspace confinement and approval requirements, leading to missing authorization (CWE-862). This allows an attacker who can influence an agent via prompt injection to read sensitive files without triggering any approval prompt. The vulnerability has a CVSS 3.1 base score of 6.2 (medium severity) with local attack vector, low complexity, no privileges required, and no user interaction needed. The issue is resolved in version 1.5.128.

An attacker with local access or the ability to influence an agent's prompt can read arbitrary files on the filesystem without authorization or approval prompts, potentially exposing sensitive information. The vulnerability does not affect integrity or availability but impacts confidentiality. There are no known exploits in the wild. The affected versions are all prior to 1.5.128.

Upgrade PraisonAIAgents to version 1.5.128 or later where this vulnerability is fixed. Since the vendor advisory does not provide additional remediation details or temporary fixes, applying the official update is the recommended action. No cloud service remediation applies as this is not a cloud-hosted product.