PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw) - ATR-2026-00544 (4ee2ed43-5e7e-584e-b23e-2804e2c37537)
Detects GHSA-9mqq-jqxf-grvw (CVSS CRITICAL, CWE-22 / CWE-94): PraisonAI MCP server configuration allows a path traversal attack that writes a Python .pth file into a site-packages directory. Python automatically executes lines in .pth files that start with 'import ' on interpreter startup, enabling persistent arbitrary code execution. An attacker who can supply a malicious MCP config can traverse from the expected tools directory into site-packages and drop an executable .pth file. Python .pth files are a legitimate Python path-extension mechanism (PEP 302) but execute arbitrary Python on import when a line begins with 'import '. Path traversal to site-packages combined with .pth content that starts with 'import os; os.system(...)' achieves RCE on every subsequent Python process start. Detection covers: (a) Path-traversal sequences targeting site-packages with .pth extension; (b) .pth file content containing import + OS execution primitives; (c) PraisonAI MCP config with directory traversal in file path fields; (d) Explicit GHSA-9mqq-jqxf-grvw exploitation framing.