Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
PraisonAI agents can write files outside project folder
published 3 months ago
Summary
The PraisonAI Python package (versions before 1.6.78) reads a configuration file that can specify any file path, including locations outside the project directory. When an agent is started without an explicit output setting, it may create or overwrite files anywhere the user has permission, which could let a malicious project change system files. Update to the latest version or ensure the config does not contain absolute or parent‑directory paths.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | mervin praison | praisonaiagents | <= 1.6.77 |
Original advisory text
Duplicate Advisory: PraisonAI: Project config can auto-save agent output outside the project root
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qjw5-xwrp-xwpq. This link is maintained to preserve external references.
### Original Description
PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.
This advisory has been withdrawn because it is a duplicate of GHSA-qjw5-xwrp-xwpq. This link is maintained to preserve external references.
### Original Description
PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.
References
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qjw5-xwrp-xw...
- https://nvd.nist.gov/vuln/detail/CVE-2026-60089
- https://github.com/MervinPraison/PraisonAI/commit/3aa9cbc2bd49c23a32be0a89a5e620...
- https://www.vulncheck.com/advisories/praisonai-before-path-traversal-via-config-...
- https://github.com/advisories/GHSA-rrqj-82cc-g6h4
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-22Path Traversal
Timeline
Published10 Jul 2026
Updated8 Oct 2026
First seen8 Oct 2026
Sources
GHSA-rrqj-82cc-g6h4 · GHSA
Track software like this
Free during beta