CVE-2026-60088 · GHSA-xpx6-x8c2-mw5w
PraisonAI: Project custom command templates can read outside-workspace files into model prompts
- Risk score
- 40/100
- CVSS
- 5.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 11 Jul 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outside_secret.txt or absolute paths in project command files to exfiltrate process-readable files into model promp…
- Affected
- praisonai (pip) <= 4.6.77
- Fix
- Upgrade praisonai to 4.6.78 or later.
- Exploitation
- No known exploitation
Story map
At a glance
praisonai: Amber, patch this week. PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute …
The flaws
- CVE-2026-60088: PraisonAI: Project custom command templates can read outside-workspace files into model prompts (CVSS 5.5 · EPSS 0%)
- CVE-2026-61445: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls (CVSS 9.9 · EPSS 1%)
- CVE-2026-61426: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure (CVSS 8.6 · EPSS 0%)
- CVE-2026-61434: PraisonAI: Shell command allowlist bypass via find -exec built-in action (CVSS 8.8 · EPSS 1%)
The fix
Upgrade praisonai: 4.6.78 · 1.7.3 or later on your release line
Who is exposed: praisonai (pip) <= 4.6.77
Where it stands
- Public proof of concept
Connects to
- Same weakness: Path traversal (CWE-22). 398 other warnings in 30 days
Why it is Yellow
- CVSS 5.5 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| praisonai | pip | <= 4.6.77 | 4.6.78 |
References
- https://github.com/advisories/GHSA-xpx6-x8c2-mw5w
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xpx6-x8c2-mw5w
- https://nvd.nist.gov/vuln/detail/CVE-2026-60088
- https://github.com/MervinPraison/PraisonAI/commit/3aa9cbc2bd49c23a32be0a89a5e620d13d843eab
- https://www.vulncheck.com/advisories/praisonai-before-path-traversal-via-custom-commands
- https://github.com/advisories/GHSA-xpx6-x8c2-mw5w
Original description
PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outside_secret.txt or absolute paths in project command files to exfiltrate process-readable files into model prompts.
Last activity 8 Oct 2026. Patch Forecast updates every hour.