CVE-2026-39305 is a critical path traversal flaw (CVSS 9.0) in PraisonAI, a multi-agent teams system. The Action Orchestrator accepts relative path segments, so a malicious action or compromised agent can write files outside the configured workspace. Versions before 1.5.113 are affected, and 1.5.113 fixes it.
What's affected
PraisonAI versions before 1.5.113 are affected. The fixed version is 1.5.113.
The issue sits in the Action Orchestrator feature. If you do not use it, your exposure is lower, but upgrading is still the simplest answer.
How to check if you're exposed
pip show praisonai
pip freeze | grep -i praisonai
Check virtual environments, containers and CI images, not just your laptop. Any version below 1.5.113 is affected.
What to do now
- Upgrade with
pip install -U praisonaiand confirm 1.5.113 or later. - Run agents under a low privilege account with write access limited to the workspace.
- Review which agents and tools can propose file writes, and treat third-party agents as untrusted.
- Rebuild container images that pinned an older release.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-22 (Path Traversal). A path that contains parent directory segments can resolve outside the folder the program meant to confine writes to. The advisory says this can overwrite sensitive system files or drop executable content on the host.
Agent frameworks make this class of bug more interesting, because the path may come from model output or another agent rather than a human. Confine file writes by resolving the final path and checking it stays inside the workspace. The record does not flag this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
PraisonAI 1.5.113.
Does an attacker need to be a person?
No. The advisory says an attacker or a compromised agent can supply the path.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
