CVE-2026-60089: PraisonAI Agents config.toml path

CISO Take

PraisonAI's Python agent framework (praisonaiagents) silently trusts a project-local .praisonai/config.toml when a developer instantiates an Agent, and it never validates the defaults.output.output_file path before writing to it. That means anyone who can get a malicious config file into a checked-out repository — a poisoned open-source template, a compromised fork, a tutorial repo — can redirect where the agent writes its response, including absolute paths or '../' traversal outside the project root, with parent directories auto-created as needed. There's no EPSS score yet, it isn't in CISA KEV, and no public exploit or Nuclei template exists, so this reads as low-likelihood-today rather than an active threat, but the exploitation bar is trivial: a one-line TOML edit plus a developer calling agent.start() without an explicit output override does the rest. Upgrade to praisonaiagents 1.6.78 or later, and until then treat any third-party or forked PraisonAI project as untrusted — audit .praisonai/config.toml before running agents against it, and flag agent processes writing outside the project directory in EDR/file-integrity monitoring.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N): the attack requires local access to a checked-out repository and user interaction (the developer running the agent), but no privileges and low complexity. Impact is confined to integrity (arbitrary file overwrite) with no direct confidentiality or availability impact, though overwriting sensitive files (shell profiles, cron entries, SSH authorized_keys, CI configs) can cascade into code execution or persistence. No EPSS data, no KEV listing, and no public PoC/scanner coverage lower near-term exploitation likelihood, but the low complexity and the popularity of cloning untrusted AI-agent starter repos keep this above purely theoretical risk.

How does the attack unfold?

Initial Access

Attacker plants a malicious .praisonai/config.toml with a path-traversal or absolute output_file value in a public or forked repository.

AML.T0010.001

Configuration Manipulation

Developer clones and runs the repository; PraisonAI automatically loads the untrusted config.toml defaults without validation.

AML.T0081

User Execution

Developer calls agent.start() without an explicit output parameter, unknowingly triggering the write to the attacker-chosen path.

AML.T0011

Impact

PraisonAI writes the agent response to the attacker-controlled path outside the project root, overwriting a sensitive file (e.g., shell profile, cron entry, SSH key file) under the developer's privileges.

Initial Access

Attacker plants a malicious .praisonai/config.toml with a path-traversal or absolute output_file value in a public or forked repository.

AML.T0010.001

Configuration Manipulation

Developer clones and runs the repository; PraisonAI automatically loads the untrusted config.toml defaults without validation.

AML.T0081

User Execution

Developer calls agent.start() without an explicit output parameter, unknowingly triggering the write to the attacker-chosen path.

AML.T0011

Impact

PraisonAI writes the agent response to the attacker-controlled path outside the project root, overwriting a sensitive file (e.g., shell profile, cron entry, SSH key file) under the developer's privileges.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI Agents	pip	—	No patch
20 dependents 67% patched ~6d to patch Full package profile →

Do you use PraisonAI Agents? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C None

I High

A None

What should I do?

1 step

Upgrade praisonaiagents to 1.6.78 or later, which validates/constrains the output_file path. Until patched, always pass an explicit output parameter to agent.start() rather than relying on config.toml defaults, and treat any repo-provided .praisonai/config.toml as untrusted input requiring review before execution. In CI/CD, avoid running PraisonAI agents against unreviewed forks or PRs without sandboxing (containers with restricted filesystem write scope, non-root users, read-only mounts outside the workspace). Detection: monitor for PraisonAI/Python processes writing outside expected project directories, and file-integrity-monitor sensitive paths (shell rc files, cron.d, authorized_keys, systemd units) on developer workstations and build agents.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Agent Framework AML.T0010.001 - AI Software AML.T0011 - User Execution AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security controls

NIST AI RMF

MANAGE-2.3 - Manage AI system supply chain risks

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-60089?

PraisonAI's Python agent framework (praisonaiagents) silently trusts a project-local .praisonai/config.toml when a developer instantiates an Agent, and it never validates the defaults.output.output_file path before writing to it. That means anyone who can get a malicious config file into a checked-out repository — a poisoned open-source template, a compromised fork, a tutorial repo — can redirect where the agent writes its response, including absolute paths or '../' traversal outside the project root, with parent directories auto-created as needed. There's no EPSS score yet, it isn't in CISA KEV, and no public exploit or Nuclei template exists, so this reads as low-likelihood-today rather than an active threat, but the exploitation bar is trivial: a one-line TOML edit plus a developer calling agent.start() without an explicit output override does the rest. Upgrade to praisonaiagents 1.6.78 or later, and until then treat any third-party or forked PraisonAI project as untrusted — audit .praisonai/config.toml before running agents against it, and flag agent processes writing outside the project directory in EDR/file-integrity monitoring.

Is CVE-2026-60089 actively exploited?

No confirmed active exploitation of CVE-2026-60089 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-60089?

Upgrade praisonaiagents to 1.6.78 or later, which validates/constrains the output_file path. Until patched, always pass an explicit `output` parameter to agent.start() rather than relying on config.toml defaults, and treat any repo-provided .praisonai/config.toml as untrusted input requiring review before execution. In CI/CD, avoid running PraisonAI agents against unreviewed forks or PRs without sandboxing (containers with restricted filesystem write scope, non-root users, read-only mounts outside the workspace). Detection: monitor for PraisonAI/Python processes writing outside expected project directories, and file-integrity-monitor sensitive paths (shell rc files, cron.d, authorized_keys, systemd units) on developer workstations and build agents.

What systems are affected by CVE-2026-60089?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local agent execution pipelines, CI/CD agent runners.

What is the CVSS score for CVE-2026-60089?

CVE-2026-60089 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal agent execution pipelinesCI/CD agent runners

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011 User Execution

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.

Exploitation Scenario

An attacker publishes or contributes to an open-source PraisonAI-based project (a tutorial repo, agent template, or a malicious fork/PR) containing a .praisonai/config.toml with `defaults.output.output_file` set to a traversal path such as "../../../../.bashrc" or an absolute path like "/etc/cron.d/task". A developer clones the repo to try it out, runs the agent normally via `agent.start()` without specifying an output path, and PraisonAI writes the agent's response — content the attacker may also partially control via the agent's prompt or task definition — to the attacker-chosen path, creating parent directories as needed. The overwritten file (a shell profile, cron job, or CI config) executes on next login, cron tick, or pipeline run, giving the attacker code execution or persistence under the victim's user privileges.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.