Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mervinpraison/praisonai

              main @ 9c495e1
            

100

Fixes

CVEs

CRITICAL

Peak severity

24.1%

Coverage

Highlights

Auth Bypass: 15 prior fixes. Scrutinize any change in this area.

src/praisonai/praisonai/gateway/server.py: most-fixed (7 issues). Treat as high-risk during review.

71 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Automatic loading and execution of local tools files from the current working directory without validation allowed remote code execution via crafted recipes. This was patched by enforcing the PRAISONAI_ALLOW_TEMPLATE_TOOLS environment opt-in flag before loading template-local tool files.

Sandbox Escape: Agent-generated code execution in the Python tools sandbox was susceptible to escapes using attribute dunder introspection and python builtins bypasses. Mitigations required restricting AST validation, blocking the 'getattr' builtin, and wrapping execution using a sandboxed subprocess environment.

Path Traversal: Improper validation of archive member paths during tarfile extraction ('Tar Slip') allowed attackers to write files outside of the target registry root directory. This was resolved by validating target extraction paths within a secure extraction utility.