PraisonAI’s MCP interface allows an attacker to invoke workflow.show, workflow.validate, or deploy.validate without authenticating. The underlying handlers, along with the dispatcher in server.py that accepts unvalidated kwargs, return the contents of any file that the host user can read, such as /etc/passwd, ~/.ssh/id_rsa, or project .env files. The weakness arises from insufficient path resolution and lack of input validation, resulting in CWE-200 (Information Exposure), CWE-22 (Path Traversal), and CWE-862 (Missing Authorization). The primary impact is direct confidentiality loss of host files, potentially exposing system credentials and sensitive data.

The vulnerability exists in MervinPraison’s PraisonAI software in versions older than 4.6.40. The affected handlers reside in mcp_server/adapters/cli_tools.py and the dispatcher in server.py. The affected products are explicitly listed as “MervinPraison:PraisonAI”.

The CVSS score of 8.7 highlights a high severity rating, yet the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly disclosed exploits as of now. Attack execution requires the attacker to send an unauthenticated MCP call to tools/call targeting one of the vulnerable endpoints, which can be performed locally or remotely if the MCP service is exposed. Because the view is unrestricted, any file readable by the host user can be exfiltrated without additional privileges.