GHSA-22cj-m4wf-fv2c

# PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal ## Summary PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The SDK reference describes the module as providing: - artifact storage for tool outputs, history, and terminal logs; - history persistence with search; and - terminal session logging. The module also exports agent-callable tool factories: - `create_history_tools()` returns `history_search`, `history_tail`, and `history_get`. - `create_terminal_tools()` returns `terminal_tail`, `terminal_grep`, and `terminal_commands`. Those tools accept `run_id` and `agent_id` arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or `..` traversal: ```python history_dir = self.base_dir / run_id / "history" return history_dir / f"{agent_id}.jsonl" ``` ```python terminal_dir = self.base_dir / run_id / "terminal" return terminal_dir / f"{agent_id}.log" ``` Because `run_id` can be an absolute path and `agent_id` can contain traversal, a lower-trust prompt/user that can call these tools can read `.jsonl` and `.log` files outside the configured Dynamic Context base directory. ## Affected Product - Repository: `MervinPraison/PraisonAI` - Ecosystem: `pip` - Package: `praisonai` - Component: Dynamic Context history and terminal tools - Current source paths: - `src/praisonai/praisonai/context/history_store.py` - `src/praisonai/praisonai/context/terminal_logger.py` - Latest PyPI version validated: `4.6.58` - Current `origin/main` validated: `1ad58ca02975ff1398efeda694ea2ab78f20cf3e` - Current `origin/main` tag validated: `v4.6.58` Suggested affected range: ```text pip:praisonai >= 3.8.1, <= 4.6.58 ``` Representative local sweep: - `3.8.1`: vulnerable - `4.0.0`: vulnerable - `4.5.113`: vulnerable - `4.6.33`: vulnerable - `4.6.34`: vulnerable - `4.6.40`: vulnerable - `4.6.50`: vulner