Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the MentionsParser class, within the _process_file_mention method. This method is responsible for handling @file: mentions in user-provided input. The core of the vulnerability lies in a fallback mechanism. When the code attempts to find a file relative to the agent's workspace and fails, it then attempts to resolve the path as an absolute path. This is done without any sanitization or validation of the file_path input. As a result, an attacker can specify an absolute path (e.g., /etc/passwd) or use path traversal characters (../) to navigate outside the intended directory and access sensitive files on the server. The exploitation of this vulnerability allows for arbitrary file read, leading to the disclosure of credentials, configuration files, or other sensitive system information. The provided PoC confirms that by crafting a message with @file:/etc/hostname, an attacker can read the system's hostname.
MentionsParser._process_file_mentionsrc/praisonai-agents/praisonaiagents/tools/mentions.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| praisonaiagents | pip | < 1.6.59 | 1.6.59 |
Setup: Clean checkout at commit d5f1114a.
Positive trigger — arbitrary file read via @file: mention:
import sys
sys.path.insert(0, 'src/praisonai-agents')
from praisonaiagents.tools.mentions import MentionsParser
parser = MentionsParser()
# Test 1: Absolute path read (bypasses workspace resolution)
result = parser._process_file_mention('/etc/hostname')
print(f'Absolute path read: {result[:80]}...')
# Test 2: Relative path with traversal
result = parser._process_file_mention('../../../etc/hostname')
print(f'Traversal read: {result[:80]}...')
Expected output:
Absolute path read: # File: /etc/hostname
```linux
<hostname>
```...
Traversal read: # File: ../../../etc/hostname
```linux
<hostname>
```...
Negative control — non-existent file:
result = parser._process_file_mention('/nonexistent/secret.txt')
# Returns: "# File: /nonexistent/secret.txt\n[File not found]"
Cleanup: No persistence or side effects — read-only operation.
An attacker who can inject @file: mentions into agent prompts (via chat messages in Telegram/Discord/Slack bots, user input in web UI, or YAML workflow configurations) can read any file accessible to the process user, including:
.env files, ~/.aws/credentials, ~/.ssh/id_rsa, API keys/etc/passwd, /etc/shadow (if process has read access)This is particularly dangerous in bot deployments where auto_approve_tools defaults to True and untrusted users can send messages containing @file: mentions.
workspace_path:def _process_file_mention(self, file_path: str) -> Optional[str]:
full_path = (self.workspace_path / file_path).resolve()
# Ensure resolved path is within workspace
if not str(full_path).startswith(str(self.workspace_path.resolve())):
return f"# File: {file_path}\n[Access denied: path outside workspace]"
if not full_path.exists():
return f"# File: {file_path}\n[File not found]"
content = full_path.read_text(encoding="utf-8")
Add symlink resolution via .resolve() to prevent symlink-based traversal.
Add a protected path guard (.env, .git, .ssh, keys, credentials).
Apply the same os.path.commonpath pattern used by skill_tools.py.