All vulnerabilities
CVE-2026-57113GHSA-f44v-7qgw-9gh9PYSEC-2026-3509

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

MervinPraison PraisonAIPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in4.6.59Fixed versionOSV
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 4.6.59praisonai, PyPIOSVpip install "praisonai>=4.6.59"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.

Text from CVE List

Affected versions 52

  • PraisonAIaffected: >= 2.6.0, < 4.6.59CVE List
  • praisonai, PyPIfrom 2.6.0, fixed in 4.6.59OSV
  • praisonai, PyPI2.6.0OSV
  • praisonai, PyPI2.6.1OSV
  • praisonai, PyPI2.6.2OSV
  • praisonai, PyPI2.6.3OSV
  • praisonai, PyPI2.6.4OSV
  • praisonai, PyPI2.6.5OSV
  • praisonai, PyPI2.6.6OSV
  • praisonai, PyPI2.6.7OSV
  • praisonai, PyPI2.6.8OSV
  • praisonai, PyPI2.7.0OSV
  • praisonai, PyPI2.8.3OSV
  • praisonai, PyPI2.8.4OSV
  • praisonai, PyPI2.8.5OSV
  • praisonai, PyPI2.8.6OSV
  • praisonai, PyPI2.8.7OSV
  • praisonai, PyPI2.8.8OSV
  • praisonai, PyPI2.8.9OSV
  • praisonai, PyPI2.9.0OSV
  • praisonai, PyPI2.9.1OSV
  • praisonai, PyPI2.9.2OSV
  • praisonai, PyPI3.0.0OSV
  • praisonai, PyPI3.0.1OSV
  • praisonai, PyPI3.0.2OSV
  • praisonai, PyPI3.0.3OSV
  • praisonai, PyPI3.0.4OSV
  • praisonai, PyPI3.0.5OSV
  • praisonai, PyPI3.0.6OSV
  • praisonai, PyPI3.0.7OSV
  • praisonai, PyPI3.0.8OSV
  • praisonai, PyPI3.0.9OSV
  • praisonai, PyPI3.1.0OSV
  • praisonai, PyPI3.1.1OSV
  • praisonai, PyPI3.1.2OSV
  • praisonai, PyPI3.1.3OSV
  • praisonai, PyPI3.1.4OSV
  • praisonai, PyPI3.1.5OSV
  • praisonai, PyPI3.1.6OSV
  • praisonai, PyPI3.1.7OSV
  • praisonai, PyPI3.1.8OSV
  • praisonai, PyPI3.1.9OSV
  • praisonai, PyPI3.10.0OSV
  • praisonai, PyPI3.10.1OSV
  • praisonai, PyPI3.10.10OSV
  • praisonai, PyPI3.10.11OSV
  • praisonai, PyPI3.10.12OSV
  • praisonai, PyPI3.10.13OSV
  • praisonai, PyPI3.10.14OSV
  • praisonai, PyPI3.10.15OSV
  • praisonai, PyPI3.10.16OSV
  • praisonai, PyPI3.10.17OSV

References 1