ghsa:GHSA-W37C-CQ55-FRJP: praisonai <= 4.6.77

GHSA-w37c-cq55-frjp

Affected technology

praisonai · <= 4.6.77
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Local · No privileges required · User interaction required

What an attacker can do

Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle. Source advisory’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as none.

GHSA-w37c-cq55-frjp

Affected technology

praisonai · <= 4.6.77
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle. OSV’s CVSS 4.0 assessment rates confidentiality impact as high; integrity and availability impact as none.