CVE-2026-44336 is a critical path traversal (CVSS 9.6) in the MCP server of PraisonAI, started with praisonai mcp serve. Default file tools accept paths with no containment check, so files can be written outside the intended folder. Upgrade praisonai to 4.6.34 or later.
What's affected
From the project advisory for the praisonai package on PyPI:
- Affected: 4.6.33 and earlier.
- Fixed: 4.6.34 and later.
The vulnerable code sits in four tools that the MCP server registers by default: rules create, rules show, rules delete and workflow show. The advisory says no configuration flag turns them off.
The advisory describes several ways to reach the tools. These include an MCP connected assistant whose context has been poisoned by untrusted web pages or documents, the HTTP stream transport started without an API key, and any stdio client that can get input to the connected model. Exposure therefore covers developer machines and agent hosts, not only servers.
How to check if you're exposed
Check the installed version:
pip show praisonai
Then find where the MCP server runs. Look for processes started with the serve command, and for any use of the HTTP stream transport without an API key:
ps aux | grep -i "praisonai mcp"
Review which assistants or clients are connected to it, and whether those clients read untrusted content such as web pages or email.
What to do now
- Upgrade praisonai to 4.6.34 or later in every environment where the MCP server is installed, including developer laptops and CI images.
- Stop running the server with the HTTP stream transport and no API key. Require a key and bind to loopback only unless you need more.
- Run the server as a user with as little write access as possible, since the primitive writes anywhere that user can write.
- Check the Python user site packages folder for unexpected
.pthfiles, and check the rules folder under the home directory for unexpected entries. - Review which connected assistants can ingest untrusted content, and limit the tools they can call.
Why it matters
The record lists a cluster of weaknesses: CWE-22 (path traversal), CWE-20 (improper input validation), CWE-94 (code injection), CWE-829 (inclusion of functionality from an untrusted control sphere) and CWE-913 (improper control of dynamically managed code resources). The core problem is simple. File names from tool call arguments were joined onto a base folder with no check that the result stayed inside it, and the dispatcher passed arguments to handlers without checking them against the schema the server advertised.
A file write anywhere the user can write is more than a file problem. The advisory explains that placing a Python path configuration file in the user site packages folder causes code to run the next time any Python process starts for that user. That is why a write primitive in a tool server becomes code execution.
MCP servers are a good example of a trust boundary that is easy to miss, because the caller is a language model that may be acting on text an attacker wrote. The record does not mark this CVE as KEV.
Quick check
Do I need to expose the server to the internet to be at risk?
No. The advisory describes local paths, such as a poisoned model context on stdio, and local processes or a rebound browser tab on a loopback HTTP server.
Which package version is the fixed one?
praisonai 4.6.34. Note that the related praisonaiagents package has its own version numbers, covered in CVE-2026-44335.
Sources
Last reviewed: 19 October 2026.
