AI Threat Alert
CVE-2026-60088: PraisonAI: path traversal leaks files into LLM prompts
MEDIUMPraisonAI versions before 4.6.78 fail to validate file path references inside custom command templates, letting an attacker-crafted project file use traversal sequences (@../outside_secret.txt) or absolute paths to pull any process-readable file into the LLM prompt context. This is a local, user-interaction-required flaw (CVSS 5.5, AV:L/UI:R) rather than a remotely wormable bug, but the confidentiality impact is high and the target class — credentials, SSH keys, cloud tokens, .env files — is exactly what attackers want once they get a developer or CI agent to run a malicious PraisonAI project. There is no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so exploitation-in-the-wild likelihood is currently low, but the vulnerability class (path traversal reaching secrets via an AI agent's own tooling) is trivial to weaponize once a proof of concept circulates. Upgrade to PraisonAI 4.6.78 or later immediately, and until patched, treat any third-party PraisonAI project/command template as untrusted code — review it before execution and run agent workloads under a restricted, least-privilege filesystem context. Security teams running AI agent frameworks should also add detection for anomalous file reads by agent processes outside their declared workspace root.
What is the risk?
Medium severity (CVSS 5.5) but high-confidence confidentiality impact: an attacker who gets a victim to load a malicious command template can read any file the PraisonAI process can access, with no privileges required. The requirement for user interaction and local attack vector caps the blast radius compared to a remote, unauthenticated bug, but AI agent developer tooling is frequently pointed at repos of unknown provenance (templates, examples, shared agent configs), which is precisely the trust boundary this bug breaks. No active exploitation, KEV listing, EPSS score, or public PoC currently exists, so this is a 'patch on the next maintenance cycle, don't page anyone' issue for most orgs — unless PraisonAI runs with access to high-value secrets (cloud credentials, CI tokens), in which case treat it as higher priority.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | — | No patch |
Do you use PraisonAI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
Upgrade PraisonAI to 4.6.78 or later immediately (fix commit: github.com/MervinPraison/PraisonAI/commit/3aa9cbc). Until patched: do not run PraisonAI command templates or projects sourced from untrusted repos, PRs, or shared templates without manual review of any @-path or file references. Run PraisonAI agent processes under a restricted OS user / container with minimal filesystem access (no read access to credential stores, SSH keys, cloud config directories). Audit process logs / prompt logs for file paths outside the expected project workspace, and specifically watch for traversal sequences (../) or absolute paths in command template content ingested by CI or automation pipelines. Rotate any credentials that may have been readable by a PraisonAI process prior to patching if provenance of run templates is uncertain.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-60088?
PraisonAI versions before 4.6.78 fail to validate file path references inside custom command templates, letting an attacker-crafted project file use traversal sequences (@../outside_secret.txt) or absolute paths to pull any process-readable file into the LLM prompt context. This is a local, user-interaction-required flaw (CVSS 5.5, AV:L/UI:R) rather than a remotely wormable bug, but the confidentiality impact is high and the target class — credentials, SSH keys, cloud tokens, .env files — is exactly what attackers want once they get a developer or CI agent to run a malicious PraisonAI project. There is no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so exploitation-in-the-wild likelihood is currently low, but the vulnerability class (path traversal reaching secrets via an AI agent's own tooling) is trivial to weaponize once a proof of concept circulates. Upgrade to PraisonAI 4.6.78 or later immediately, and until patched, treat any third-party PraisonAI project/command template as untrusted code — review it before execution and run agent workloads under a restricted, least-privilege filesystem context. Security teams running AI agent frameworks should also add detection for anomalous file reads by agent processes outside their declared workspace root.
Is CVE-2026-60088 actively exploited?
No confirmed active exploitation of CVE-2026-60088 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-60088?
Upgrade PraisonAI to 4.6.78 or later immediately (fix commit: github.com/MervinPraison/PraisonAI/commit/3aa9cbc). Until patched: do not run PraisonAI command templates or projects sourced from untrusted repos, PRs, or shared templates without manual review of any @-path or file references. Run PraisonAI agent processes under a restricted OS user / container with minimal filesystem access (no read access to credential stores, SSH keys, cloud config directories). Audit process logs / prompt logs for file paths outside the expected project workspace, and specifically watch for traversal sequences (../) or absolute paths in command template content ingested by CI or automation pipelines. Rotate any credentials that may have been readable by a PraisonAI process prior to patching if provenance of run templates is uncertain.
What systems are affected by CVE-2026-60088?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, developer/CI automation tooling, local AI agent execution.
What is the CVSS score for CVE-2026-60088?
CVE-2026-60088 has a CVSS v3.1 base score of 5.5 (MEDIUM).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011 User Execution AML.T0025 Exfiltration via Cyber Means AML.T0037 Data from Local System Compliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outside_secret.txt or absolute paths in project command files to exfiltrate process-readable files into model prompts.
Exploitation Scenario
An attacker publishes or contributes a seemingly legitimate PraisonAI agent project (e.g., a shared automation template on GitHub or an internal wiki) containing a custom command file that references a path like @../../.env or an absolute path such as @/home/user/.aws/credentials. A developer or CI pipeline clones the project and runs the associated PraisonAI command as part of normal workflow (user interaction satisfied). PraisonAI resolves the path without validating it stays inside the project workspace, reads the target file, and injects its full contents into the prompt sent to the LLM. The secret material now appears in the model's context and potentially in its response or in prompt/response logs; if the agent has any outbound tool (webhook call, email send, API request), the attacker can chain that access to exfiltrate the credentials off the victim's machine entirely through the agent's own legitimate tooling.
Weaknesses (CWE)
CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N References
Timeline
Related Vulnerabilities
CVE-2026-61447 10.0 PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonai CVE-2026-61445 9.9 PraisonAI: AICoder root RCE via unsanitized tool calls
Same package: praisonai CVE-2026-47392 9.9 praisonaiagents: RCE via Python sandbox bypass
Same package: praisonai GHSA-vmmj-pfw7-fjwp 9.9 praisonai: sandbox escape gives RCE via codeMode tool
Same package: praisonai GHSA-vc46-vw85-3wvm 9.8 PraisonAI: RCE via malicious workflow YAML execution
Same package: praisonai