PraisonAI is a multi-agent teams system. Before version 4.6.59, the CODE_TOOLS wrappers keep the _workspace_root variable as None and pass workspace=None to helper functions such as read_file, search_replace, and apply_diff. These helpers enforce path containment only when the workspace parameter is truthy. If an application exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace is called, it can allow prompt-influenced calls to read and modify files outside the intended project directory. This path traversal vulnerability allows unauthorized file access and modification. The issue is resolved in version 4.6.59.

An attacker with limited privileges (PR:L) and user interaction (UI:R) can exploit this vulnerability to read and modify files outside the intended project directory, potentially leading to unauthorized disclosure and modification of sensitive files. The vulnerability does not impact availability. The CVSS 3.1 base score is 7.3 (High), reflecting high confidentiality and integrity impact with network attack vector and low attack complexity.

Upgrade PraisonAI to version 4.6.59 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated. Since this is not a cloud service, remediation depends on applying the official fix.