CVE-2026-61431 · GHSA-q7m5-3jmv-vm48
PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace
- Risk score
- 44/100
- CVSS
- 5.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 10 Jul 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in t…
- Affected
- praisonai (pip) <= 4.6.77
- Fix
- Upgrade praisonai to 4.6.78 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.5 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| praisonai | pip | <= 4.6.77 | 4.6.78 |
References
- https://github.com/advisories/GHSA-q7m5-3jmv-vm48
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q7m5-3jmv-vm48
- https://nvd.nist.gov/vuln/detail/CVE-2026-61431
- https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0
- https://www.vulncheck.com/advisories/praisonai-before-path-traversal-via-contextgatherer
- https://github.com/advisories/GHSA-q7m5-3jmv-vm48
Original description
PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.
Last activity 8 Oct 2026. Patch Forecast updates every hour.