PraisonAIAgents versions before 1.5.128 contain an authorization bypass vulnerability (CWE-862) in the read_skill_file() function. This function accepts an unrestricted skill_path parameter and allows reading arbitrary files from the filesystem. Unlike file_tools.read_file, which enforces workspace boundaries, and run_skill_script, which requires critical-level approval, read_skill_file lacks these protections. This enables an attacker who can influence an agent via prompt injection to read sensitive files without any approval prompt. The vulnerability is addressed in version 1.5.128.

An attacker able to influence the agent's prompts can read arbitrary files on the filesystem without authorization or triggering approval workflows. This can lead to the exfiltration of sensitive data, impacting confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Upgrade PraisonAIAgents to version 1.5.128 or later, where this vulnerability is fixed. Since no official vendor advisory or patch link is provided, verify the update directly from the vendor or trusted sources. Until patched, restrict access to the affected versions and monitor for suspicious activity related to file access by agents.