PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw)
PraisonAI's MCP server accepts file path fields for tool configuration without properly checking them. An attacker can use directory traversal sequences to escape the intended tools folder and write a malicious .pth file into Python's site-packages directory, which Python will automatically execute every time it starts up.
How the attack works
An attacker submits an MCP configuration to PraisonAI containing a file path with '../' traversal sequences instead of a normal filename. This lets the write operation escape the expected tools directory and land inside a Python site-packages folder. The attacker crafts the file with a .pth extension and content that starts with 'import os; os.system(...)' or similar. Because Python automatically runs any line beginning with 'import ' in .pth files found in site-packages, the malicious code executes the next time any Python interpreter on that system starts, giving the attacker persistent code execution.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 04b8c72a-2d18-4ef6-b1c8-1769bedc442e
- Severity
- Critical
Why it matters
An attacker with the ability to submit MCP configuration data can achieve arbitrary code execution that survives reboots and reappears every time Python restarts, effectively taking over the host running the PraisonAI MCP server.
What you can do
- →Validate and canonicalize all file path fields in MCP tool configurations; reject any path containing '../' or resolving outside the intended tools directory.
- →Restrict write permissions on site-packages directories so the MCP server process cannot write there.
- →Audit existing .pth files in site-packages for lines starting with 'import ' followed by execution calls like os.system or subprocess.
- →Run the PraisonAI MCP server with a minimal-privilege account that has no write access to Python installation directories.
Known benign look-alikes
- Python packaging tools creating .pth files in site-packages via legitimate pip install.
- PYTHONPATH manipulation for virtual environment setup — without traversal sequences.
- Security advisory text quoting GHSA-9mqq-jqxf-grvw traversal payload.