The vulnerability exists in PraisonAI’s Dynamic Context Discovery feature, which exposes artifact helper tools that lack validation of the artifact_path supplied by callers. Because the tools wrap the caller-supplied path into an ArtifactRef and read it directly from the host filesystem, an attacker who can influence the tool arguments can read any file readable by the PraisonAI process, including project .env files, cloud credentials, SSH keys, source files, or other local data. This flaw is a confidentiality breach based on improper access control and information disclosure.

MervinPraison’s PraisonAI product is affected from version 3.8.1 up to, but not including, version 4.6.59. In all those releases, the Dynamic Context Discovery guidance allows untrusted path inputs to be read from the host environment.

The CVSS score of 7.5 indicates a high severity, and EPSS is not available, implying no current exploit data is known. The vulnerability is not listed in KEV, suggesting it may not yet be actively exploited. However, the likely attack vector is remote: an attacker who can forge or influence prompts that call the artifact tools can supply a malicious artifact_path and retrieve arbitrary host files. The flaw would affect any environment where the PraisonAI process has access to sensitive files, and its exploitation would compromise confidentiality for the entire system.