CVE-2026-60089

Description

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.

PUBLISHED Reserved 2026-07-08 | Published 2026-07-10 | Updated 2026-07-10 | Assigner VulnCheck

Problem types

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Credits

rexpository reporter

References

github.com/...isonAI/security/advisories/GHSA-qjw5-xwrp-xwpq exploit

github.com/...isonAI/security/advisories/GHSA-qjw5-xwrp-xwpq (GitHub Security Advisory (GHSA-qjw5-xwrp-xwpq)) vendor-advisory

github.com/...ommit/3aa9cbc2bd49c23a32be0a89a5e620d13d843eab patch

www.vulncheck.com/...i-before-path-traversal-via-config-toml (VulnCheck Advisory: PraisonAI before 1.6.78 Path Traversal via config.toml) third-party-advisory

cve.org (CVE-2026-60089)

nvd.nist.gov (CVE-2026-60089)

Download JSON