PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

Summary

PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The SDK reference describes the module as providing:

• artifact storage for tool outputs, history, and terminal logs;
• history persistence with search; and
• terminal session logging.

The module also exports agent-callable tool factories:

• create_history_tools() returns history_search, history_tail, and history_get.
• create_terminal_tools() returns terminal_tail, terminal_grep, and terminal_commands.

Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal:

history_dir = self.base_dir / run_id / "history"
return history_dir / f"{agent_id}.jsonl"

terminal_dir = self.base_dir / run_id / "terminal"
return terminal_dir / f"{agent_id}.log"

Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory.

Affected Product

• Repository: MervinPraison/PraisonAI
• Ecosystem: pip
• Package: praisonai
• Component: Dynamic Context history and terminal tools
• Current source paths:
  • src/praisonai/praisonai/context/history_store.py
  • src/praisonai/praisonai/context/terminal_logger.py
• Latest PyPI version validated: 4.6.58
• Current origin/main validated: 1ad58ca02975ff1398efeda694ea2ab78f20cf3e
• Current origin/main tag validated: v4.6.58

Suggested affected range:

pip:praisonai >= 3.8.1, <= 4.6.58

Representative local sweep:

• 3.8.1: vulnerable
• 4.0.0: vulnerable
• 4.5.113: vulnerable
• 4.6.33: vulnerable
• 4.6.34: vulnerable
• 4.6.40: vulnerable
• 4.6.50:...