PraisonAI ast_grep_rewrite Tool Bypasses Approval Gating Allowing Arbitrary File Modification

Vulnerability Overview Vulnerability Name: arbitrary file rewriting, bypassing the gate (CWE-862) Description: Target: PraisonAI (MervinPraison/PraisonAI) Affected Component: in Affected Versions: branch (commit 0e978d715621c5d43a3b1a2e198f84899f2fa), reproduced in PraisonAIagents PyPI version 1.6.52 Category: CWE-862 (Missing Authorization) CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (Base Score 6.1) Severity: Medium (6.1/10) Summary: Tools within that modify disk files or execute code are typically wrapped with the decorator. This decorator routes the call through an interactive approval process before execution, closing the operation or raising a (if no approval backend is configured) upon failure. This vulnerability affects every sibling mutation entry point. Scope of Impact Affected Files: - line 212 (High Risk) - line 239 (High Risk) - line 266 (High Risk) - line 38 (High Risk) - line 155 (High Risk) - line 32 (Critical Risk) - line 352 (Critical Risk) Specific Vulnerability: - line 148 is structurally similar to other tools but lacks the decorator and does not import . With (LLM-controllable), it constructs the command (lines 204-211) and invokes (line 213), modifying all files matching the pattern under the . There is no approval gate, no workspace check, and no sandboxing. The function is registered as a top-level function ( line 182) and exposed via the built-in configuration profile. Secondary Defect: - On the path, returns the literal string "No changes made" to the caller, even though it modifies files (the return of "No changes made" occurs when this path is reached at line 238 of ). Consequently, an operator inspecting the tool output will not see the recorded modifications. Remediation Recommended Fixes: - Add the decorator to . - Add a workspace boundary check (similar to line 27 in ). - Fix the "No changes made" return value to reflect actual modifications; apply the decorator to (line 243 of ) to enforce read-only mode and prevent undecorated recursive descent. POC Code Threat Model Local LLM Agent: Running locally, with a tool surface that includes (via the configuration profile or direct import). Trigger Conditions: The operator instructs the agent to refactor code, or an attacker injects a prompt into distributed documentation/RAG content/any LLM-visible input, enticing the agent to call with attacker-chosen pattern, replacement, and path (the flag is requestable in LLM-visible tool modes). The agent can rewrite any file writable by the host process—source code trees, build configurations, definitions, and the agent's own source. Replacements using are recursive. Since replacement text is arbitrary, a pointer to a file that is subsequently imported or executed converts this write primitive into code execution—a prompt-based escalation noted in the CVSS vector. Coordinated Disclosure Delivered privately via GitHub Security Advisory; no public CVE assigned, no public posts, and no non-private vendor contact. Kai Aizen / SnailSplit — kai@snailsplit.com — PGP available on request.

Goal Reached Thanks to every supporter — we hit 100%!

PraisonAI ast_grep_rewrite Tool Bypasses Approval Gating Allowing Arbitrary File Modification

More from this source