PraisonAI Code agent tools fail open without a workspace boundary
Date: 2026-06
Affected: pip/praisonai
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CWE: CWE-200
CWE-22
CWE-863
CVSS: 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)

# PraisonAI Code agent tools fail open without a workspace boundary ## Summary PraisonAI Code's agent-compatible `CODE_TOOLS` wrappers keep a global workspace root initialized to `None`. If an application uses `CODE_TOOLS`, `code_read_file`, `code_search_replace`, or `code_apply_diff` before calling `set_workspace()`, the wrappers pass `workspace=None` into lower-level helpers that only enforce path containment when a workspace is truthy. Absolute paths outside the intended project workspace are then read and modified. The official examples correctly call `set_workspace()` before `CODE_TOOLS`, and this report does not claim configured workspaces are ineffective. The issue is the fail-open default. PraisonAI's security documentation describes workspace boundaries as the path-traversal protection mechanism, and the already-published Python API arbitrary file write advisory (`GHSA-hvhp-v2gc-268q`) was fixed by defaulting an unset workspace to `os.getcwd()`. The adjacent read and edit paths reached through `CODE_TOOLS` still fail open. ## Affected Components - Package: `praisonai` - Current upstream main tested: `2f9677abb2ea68eab864ee8b6a828fd0141612e1` - Latest tested release: `v4.6.57` - Primary files: - `src/praisonai/praisonai/code/agent_tools.py` - `src/praisonai/praisonai/code/tools/read_file.py` - `src/praisonai/praisonai/code/tools/search_replace.py` - `src/praisonai/praisonai/code/tools/apply_diff.py` ## Root Cause `agent_tools.py` initializes `_workspace


Mitigations:

Architectural layers (MAESTRO):