CVE-2026-60088: PraisonAI path traversal leaks

Q: Is CVE-2026-60088 actively exploited?

No confirmed active exploitation of CVE-2026-60088 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-60088?

Upgrade PraisonAI to 4.6.78 or later immediately (fix commit: github.com/MervinPraison/PraisonAI/commit/3aa9cbc). Until patched: do not run PraisonAI command templates or projects sourced from untrusted repos, PRs, or shared templates without manual review of any @-path or file references. Run PraisonAI agent processes under a restricted OS user / container with minimal filesystem access (no read access to credential stores, SSH keys, cloud config directories). Audit process logs / prompt logs for file paths outside the expected project workspace, and specifically watch for traversal sequences (../) or absolute paths in command template content ingested by CI or automation pipelines. Rotate any credentials that may have been readable by a PraisonAI process prior to patching if provenance of run templates is uncertain.

Q: What systems are affected by CVE-2026-60088?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, developer/CI automation tooling, local AI agent execution.

Q: What is the CVSS score for CVE-2026-60088?

CVE-2026-60088 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.22%.

CISO Take

PraisonAI versions before 4.6.78 fail to validate file path references inside custom command templates, letting an attacker-crafted project file use traversal sequences (@../outside_secret.txt) or absolute paths to pull any process-readable file into the LLM prompt context. This is a local, user-interaction-required flaw (CVSS 5.5, AV:L/UI:R) rather than a remotely wormable bug, but the confidentiality impact is high and the target class — credentials, SSH keys, cloud tokens, .env files — is exactly what attackers want once they get a developer or CI agent to run a malicious PraisonAI project. There is no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so exploitation-in-the-wild likelihood is currently low, but the vulnerability class (path traversal reaching secrets via an AI agent's own tooling) is trivial to weaponize once a proof of concept circulates. Upgrade to PraisonAI 4.6.78 or later immediately, and until patched, treat any third-party PraisonAI project/command template as untrusted code — review it before execution and run agent workloads under a restricted, least-privilege filesystem context. Security teams running AI agent frameworks should also add detection for anomalous file reads by agent processes outside their declared workspace root.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Medium severity (CVSS 5.5) but high-confidence confidentiality impact: an attacker who gets a victim to load a malicious command template can read any file the PraisonAI process can access, with no privileges required. The requirement for user interaction and local attack vector caps the blast radius compared to a remote, unauthenticated bug, but AI agent developer tooling is frequently pointed at repos of unknown provenance (templates, examples, shared agent configs), which is precisely the trust boundary this bug breaks. No active exploitation, KEV listing, EPSS score, or public PoC currently exists, so this is a 'patch on the next maintenance cycle, don't page anyone' issue for most orgs — unless PraisonAI runs with access to high-value secrets (cloud credentials, CI tokens), in which case treat it as higher priority.

How does the attack unfold?

Craft malicious template

Attacker embeds a path traversal or absolute-path reference (e.g., @../outside_secret.txt) inside a PraisonAI custom command template distributed via a shared project or repo.

AML.T0079

Victim execution

A developer or automated pipeline clones the project and runs the associated PraisonAI command, triggering resolution of the unvalidated path.

AML.T0011

Local file read into prompt

PraisonAI reads the out-of-workspace file and injects its contents directly into the LLM prompt context.

AML.T0037

Disclosure / potential exfiltration

The leaked content surfaces in model output or logs, and can be relayed externally if the agent has outbound tool access.

AML.T0025

Craft malicious template

Attacker embeds a path traversal or absolute-path reference (e.g., @../outside_secret.txt) inside a PraisonAI custom command template distributed via a shared project or repo.

AML.T0079

Victim execution

A developer or automated pipeline clones the project and runs the associated PraisonAI command, triggering resolution of the unvalidated path.

AML.T0011

Local file read into prompt

PraisonAI reads the out-of-workspace file and injects its contents directly into the LLM prompt context.

AML.T0037

Disclosure / potential exfiltration

The leaked content surfaces in model output or logs, and can be relayed externally if the agent has outbound tool access.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 4.6.77	`4.6.78`
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACLow

PRNone

UIRequired

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

Upgrade PraisonAI to 4.6.78 or later immediately (fix commit: github.com/MervinPraison/PraisonAI/commit/3aa9cbc). Until patched: do not run PraisonAI command templates or projects sourced from untrusted repos, PRs, or shared templates without manual review of any @-path or file references. Run PraisonAI agent processes under a restricted OS user / container with minimal filesystem access (no read access to credential stores, SSH keys, cloud config directories). Audit process logs / prompt logs for file paths outside the expected project workspace, and specifically watch for traversal sequences (../) or absolute paths in command template content ingested by CI or automation pipelines. Rotate any credentials that may have been readable by a PraisonAI process prior to patching if provenance of run templates is uncertain.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakagePrivacy ViolationAgentFrameworkAML.T0011- User Execution AML.T0025- Exfiltration via Cyber Means AML.T0037- Data from Local System

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluation

OWASP LLM Top 10

LLM06:2025-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-60088?

PraisonAI versions before 4.6.78 fail to validate file path references inside custom command templates, letting an attacker-crafted project file use traversal sequences (@../outside_secret.txt) or absolute paths to pull any process-readable file into the LLM prompt context. This is a local, user-interaction-required flaw (CVSS 5.5, AV:L/UI:R) rather than a remotely wormable bug, but the confidentiality impact is high and the target class — credentials, SSH keys, cloud tokens, .env files — is exactly what attackers want once they get a developer or CI agent to run a malicious PraisonAI project. There is no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so exploitation-in-the-wild likelihood is currently low, but the vulnerability class (path traversal reaching secrets via an AI agent's own tooling) is trivial to weaponize once a proof of concept circulates. Upgrade to PraisonAI 4.6.78 or later immediately, and until patched, treat any third-party PraisonAI project/command template as untrusted code — review it before execution and run agent workloads under a restricted, least-privilege filesystem context. Security teams running AI agent frameworks should also add detection for anomalous file reads by agent processes outside their declared workspace root.

Is CVE-2026-60088 actively exploited?

No confirmed active exploitation of CVE-2026-60088 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-60088?

Upgrade PraisonAI to 4.6.78 or later immediately (fix commit: github.com/MervinPraison/PraisonAI/commit/3aa9cbc). Until patched: do not run PraisonAI command templates or projects sourced from untrusted repos, PRs, or shared templates without manual review of any @-path or file references. Run PraisonAI agent processes under a restricted OS user / container with minimal filesystem access (no read access to credential stores, SSH keys, cloud config directories). Audit process logs / prompt logs for file paths outside the expected project workspace, and specifically watch for traversal sequences (../) or absolute paths in command template content ingested by CI or automation pipelines. Rotate any credentials that may have been readable by a PraisonAI process prior to patching if provenance of run templates is uncertain.

What systems are affected by CVE-2026-60088?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, developer/CI automation tooling, local AI agent execution.

What is the CVSS score for CVE-2026-60088?

CVE-2026-60088 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

agent frameworksdeveloper/CI automation toolinglocal AI agent execution

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0025Exfiltration via Cyber Means

AML.T0037Data from Local System

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outside_secret.txt or absolute paths in project command files to exfiltrate process-readable files into model prompts.

Exploitation Scenario

An attacker publishes or contributes a seemingly legitimate PraisonAI agent project (e.g., a shared automation template on GitHub or an internal wiki) containing a custom command file that references a path like @../../.env or an absolute path such as @/home/user/.aws/credentials. A developer or CI pipeline clones the project and runs the associated PraisonAI command as part of normal workflow (user interaction satisfied). PraisonAI resolves the path without validating it stays inside the project workspace, reads the target file, and injects its full contents into the prompt sent to the LLM. The secret material now appears in the model's context and potentially in its response or in prompt/response logs; if the agent has any outbound tool (webhook call, email send, API request), the attacker can chain that access to exfiltrate the credentials off the victim's machine entirely through the agent's own legitimate tooling.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.