CVE-2026-44336 - Vulnerability Analysis

Overview

PraisonAI < 4.6.34 contains a path traversal in MCP server file-handling tools caused by lack of containment checks on file paths, letting attackers write arbitrary files and escalate to remote code execution, exploit requires write access to user environment.

Severity & Score

Impact

Attackers can write arbitrary files and achieve remote code execution in subsequent Python processes, leading to full user-level compromise.

Mitigation

Update to version 4.6.34 or later.

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mqq-jqxf-grvw

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner