PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
# PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
Summary
PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools
through ctx.get_tools():
```python
ctx = setup_dynamic_context()
agent = Agent(
instructions="You are a data analyst.",
tools=ctx.get_tools(),
hooks=[ctx.get_middleware()],
)
```
The official documentation describes these helpers as a way for the agent to
explore large tool-output artifacts that were queued by the middleware:
- large tool outputs are saved as artifacts;
- the agent receives compact artifact references; and
- the agent uses
artifact_tail and artifact_grep to explore that data.
The implemented artifact tools do not enforce that the supplied
artifact_path is an artifact created by the configured store or that it lives
under the configured artifact base directory. Instead, artifact_head,
artifact_tail, artifact_grep, and artifact_chunk wrap the caller-supplied
path directly into an ArtifactRef and then read it from the host filesystem.
As a result, any prompt/user/tool-caller that can influence those tool
arguments can read files readable by the PraisonAI process, such as project
.env files, cloud credentials, SSH keys, source files, or other local data.
Affected Product
- Repository:
MervinPraison/PraisonAI - Ecosystem:
pip - Package:
praisonai - Component: Dynamic Context Discovery artifact tools
- Current source path:
src/praisonai/praisonai/context/queue.py - Artifact store path:
src/praisonai/praisonai/context/artifact_store.py - Latest PyPI version validated:
4.6.58 - Current
origin/main validated:
1ad58ca02975ff1398efeda694ea2ab78f20cf3e
- Current
origin/main tag validated: v4.6.58
Suggested affected range:
```text
pip:praisonai >= 3.8.1, <= 4.6.58
```
Representative local sweep:
3.8.1: vulnerable4.0.0: vulnerable4.5.113: vulnerable4.6.33: vulnerable4.6.34: vulnerable4.6.40: vulnerable4.6.50: vulnerable4.6.58: vulnerable
Root Cause
create_artifact_tools() creates an artifact store bound to base_dir, but the
read tools do not use base_dir for containment.
For example, artifact_head() accepts artifact_path and immediately creates
an ArtifactRef with that path:
```python
def artifact_head(artifact_path: str, lines: int = 50) -> str:
ref = ArtifactRef(path=artifact_path, summary="", size_bytes=0)
try:
return artifact_store.head(ref, lines=lines)
except FileNotFoundError:
return f"Error: Artifact not found: {artifact_path}"
```
artifact_tail(), artifact_grep(), and artifact_chunk() have the same
pattern. They trust the caller-supplied path rather than resolving it through
an artifact identifier, store lookup, manifest, or base-directory containment
check.
The store methods then read that path directly:
```python
def head(self, ref: ArtifactRef, lines: int = 50) -> str:
file_path = Path(ref.path)
if not file_path.exists():
raise FileNotFoundError(f"Artifact not found: {ref.path}")
result_lines = []
with open(file_path, "r", encoding="utf-8", errors="replace") as f:
...
```
There is no check equivalent to:
```python
resolved = Path(ref.path).resolve()
base = self.base_dir.resolve()
resolved.relative_to(base)
```
There is also no check that the file has a valid .meta sidecar or appears in
artifact_list().
Local PoV
Run against the latest PyPI package:
```bash
uv run --with 'praisonai==4.6.58' \
python poc/pov_prai_cand_026_artifact_tools_arbitrary_file_read.py --json
```
The PoV:
1. Creates a temporary artifact base directory.
2. Creates a separate outside-secret.txt file outside that base directory.
3. Stores one legitimate artifact through FileSystemArtifactStore.store().
4. Calls artifact_head() on the legitimate artifact as a positive control.
5. Calls artifact_head(), artifact_grep(), and artifact_chunk() on the
outside file path.
6. Confirms artifact_list() does not list the outside file.
Observed output summary from evidence/pov-pypi-4.6.58.json:
```json
{
"package": "praisonai",
"package_version": "4.6.58",
"controls": {
"outside_file_not_listed": true,
"outside_file_outside_base_dir": true,
"valid_artifact_read_works": true
},
"outside_head": "PRAI-CAND-026-OUTSIDE-ARTIFACT-SECRET",
"outside_grep": "Found 1 matches:\\n\\n--- Line 1 ---\\n> PRAI-CAND-026-OUTSIDE-ARTIFACT-SECRET\\n second line",
"outside_chunk": "PRAI-CAND-026-OUTSIDE-ARTIFACT-SECRET",
"outside_file_listed_by_artifact_list": false,
"vulnerable": true
}
```
The PoV was rerun successfully after a fresh origin/main fetch; see
evidence/pov-pypi-4.6.58-rerun.json.
The PoV is local-only. It does not start a server, contact a third-party
target, or use real credentials.
Why This Is Not I
