CVE-2026-44336

The MCP server (`praisonai mcp serve`) registers four file handling tools that accept a path or filename parameter from JSON-RPC call arguments and combine it directly with the `~/.praison/rules/` directory without any containment check. The JSON-RPC dispatcher passes the `params["arguments"]` parameters directly to each handler without validation against the declared input schema. An attacker can set the value `rule_name="../../<any-path>"`, which allows escaping the rules directory and writing a file to any location accessible to the current user. Placing a malicious `.pth` file in the user's `site-packages` directory results in execution of arbitrary Python code every time a Python process is subsequently launched — including when invoking the `praisonai` CLI, running a script in an IDE, a REPL session, or a background-running Python service.

An attacker can write arbitrary files within the scope of permissions of the running user, and by writing a malicious `.pth` file to the `site-packages` directory, can gain persistent and automatic execution of arbitrary code in all subsequent Python processes of that user.

PraisonAI must be updated to version 4.6.34 or later, in which the vendor introduced appropriate path validation mechanisms. Details are available in the vendor's references: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mqq-jqxf-grvw

PraisonAI (Praison product) in versions prior to 4.6.34 that use the MCP server functionality (`praisonai mcp serve`).