Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-60089 · GHSA-qjw5-xwrp-xwpq

PraisonAI: Project config can auto-save agent output outside the project root

Risk score
40/100
CVSS
5.5 v3.1
Exploit chance (30 days)
0.2%
Published
10 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the …
Affected
praisonaiagents (pip) <= 1.6.77
Fix
Upgrade praisonaiagents to 1.6.78 or later.
Exploitation
No known exploitation

Story map

Story map: praisonaiagentsTHE FLAWSTHE FIXCVE-2026-60089PraisonAI: Project config canauto-save agent output outsidethe project rootCVSS 5.5 · EPSS 0%CVE-2026-61447PraisonAI: CodeAgent ExecutesLLM-Generated Code WithoutSandboxing and Leaks All…CVSS 10.0 · EPSS 2%CVE-2026-61429PraisonAI:Crawl4AI/Chromium backend isalso affected by the…CVSS 8.5 · EPSS 0%CVE-2026-61446PraisonAI: PluginAuto-Discovery ExecutesArbitrary Python Files…CVSS 8.4 · EPSS 0%Upgrade praisonaiagents1.6.78or later on your release lineWho is exposedpraisonaiagents (pip) <= 1.6.77RED · ACT TODAYpraisonaiagentsPraisonAI before 1.6.78 containsa remote code executionvulnerability inCodeAgent._execute_python()that executes LLM-generatedPython code without ASTvalidation, import restrictions…Where it standsPublic proof of conceptCONNECTS TOSame weaknessPath traversal (CWE-22)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

praisonaiagents: Red, act today. PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execut…

The flaws

  • CVE-2026-60089: PraisonAI: Project config can auto-save agent output outside the project root (CVSS 5.5 · EPSS 0%)
  • CVE-2026-61447: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets (CVSS 10.0 · EPSS 2%)
  • CVE-2026-61429: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass (CVSS 8.5 · EPSS 0%)
  • CVE-2026-61446: PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification (CVSS 8.4 · EPSS 0%)

The fix

Upgrade praisonaiagents: 1.6.78 or later on your release line

Who is exposed: praisonaiagents (pip) <= 1.6.77

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.5 medium
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
praisonaiagentspip<= 1.6.771.6.78

References

Original description

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.

Last activity 8 Oct 2026. Patch Forecast updates every hour.