CVE-2026-60088: PraisonAI Path Traversal Vulnerability

CVE-2026-60088 Overview

CVE-2026-60088 is a path traversal vulnerability [CWE-22] affecting PraisonAI versions before 4.6.78. The framework fails to validate file path references embedded in custom command templates. Attackers can insert traversal sequences such as @../outside_secret.txt or absolute paths into project command files. When the template is processed, PraisonAI reads the referenced files and inlines their contents into model prompts.

This allows an attacker with the ability to influence command templates to exfiltrate any file readable by the PraisonAI process. Sensitive artifacts such as SSH keys, environment files, and credential stores fall within reach.

Critical Impact
Attackers can exfiltrate arbitrary process-readable files by injecting path traversal references into custom command templates, leaking secrets into LLM prompt context.

Affected Products

PraisonAI versions prior to 4.6.78
Deployments using custom command templates with @file references
Multi-user or shared-workspace PraisonAI installations

Discovery Timeline

2026-07-11 - CVE-2026-60088 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-60088

Vulnerability Analysis

PraisonAI supports a template syntax that lets authors reference external files using an @ prefix. The referenced file contents are read from disk and injected into the resulting model prompt at command execution time. The template resolver in versions before 4.6.78 performs no canonicalization or containment check against the intended workspace root.

An attacker who supplies or modifies a command template can therefore reference paths outside the workspace. Payloads such as @../../etc/passwd, @/root/.ssh/id_rsa, or @../outside_secret.txt resolve to files anywhere on the filesystem readable by the PraisonAI process. The resolver then places the file contents into the prompt sent to the language model. The result is disclosure of sensitive data to whichever party receives the model output, including remote model providers and end users.

Root Cause

The root cause is missing path validation in the custom command template loader. The resolver treats @-prefixed strings as trusted file references and does not enforce that resolved paths remain within the project workspace. Traversal segments (../) and absolute paths are accepted verbatim, matching the classic [CWE-22] path traversal pattern.

Attack Vector

Exploitation requires local access and user interaction, as an operator must run a project that contains the malicious command template. A shared repository, a pulled community template, or a compromised collaborator commit are realistic delivery paths. Once executed, the file contents are exfiltrated through the model prompt channel, which is often logged or forwarded to external inference providers.

No verified exploit code is public. See the VulnCheck Security Advisory and GitHub Security Advisory GHSA-xpx6-x8c2-mw5w for technical details.

Detection Methods for CVE-2026-60088

Indicators of Compromise

Command template files containing @ references with ../ sequences or absolute paths outside the project directory.
PraisonAI process reads of sensitive files such as /etc/passwd, ~/.ssh/, or .env outside the workspace.
Outbound LLM API traffic containing recognizable secrets, private key headers, or configuration file fragments.

Detection Strategies

Scan repositories and workspaces for command templates matching the regex @(\.\./|/) to surface out-of-workspace references.
Monitor process file access using auditd, eBPF, or endpoint telemetry, and alert when the PraisonAI process opens files outside its project root.
Inspect outbound prompts to model providers for high-entropy strings or known secret patterns using data loss prevention rules.

Monitoring Recommendations

Log every file read performed by the template resolver and forward events to a centralized data lake for correlation.
Baseline the expected file access footprint of PraisonAI workloads and alert on deviations, particularly reads of credential stores or SSH directories.
Track PraisonAI version inventory across hosts to identify systems still running builds prior to 4.6.78.

How to Mitigate CVE-2026-60088

Immediate Actions Required

Upgrade PraisonAI to version 4.6.78 or later on all hosts that execute agent workflows.
Audit existing command template files for @ references pointing outside the intended workspace and remove any suspicious entries.
Rotate credentials, tokens, and keys that may have been readable by the PraisonAI process on affected systems.

Patch Information

The fix is delivered in the upstream commit 3aa9cbc2bd49c23a32be0a89a5e620d13d843eab and released in PraisonAI 4.6.78. The patch adds validation that constrains resolved template file paths to the project workspace. Refer to the GitHub Security Advisory for the maintainer's guidance.

Workarounds

Run PraisonAI under a dedicated, unprivileged user account with filesystem access limited to the project workspace.
Apply mandatory access control such as AppArmor or SELinux profiles that deny reads outside the project directory.
Review and pin trusted command templates only; reject templates from untrusted contributors until the upgrade is applied.

bash

# Configuration example: upgrade PraisonAI and verify version
pip install --upgrade 'praisonai>=4.6.78'
python -c "import praisonai; print(praisonai.__version__)"

# Optional: restrict the runtime user's filesystem view
sudo -u praisonai-runner \
  firejail --private=/opt/praisonai/workspace \
  praisonai run project.yaml