CVE-2026-60089: PraisonAI Path Traversal Vulnerability

CVE-2026-60089 Overview

CVE-2026-60089 is a path traversal vulnerability [CWE-22] in PraisonAI, distributed as the praisonaiagents pip package, affecting versions before 1.6.78. The flaw resides in how the Agent constructor automatically loads defaults from a project-local .praisonai/config.toml file without validating the defaults.output.output_file path. A repository-controlled configuration can specify an absolute path or one containing .. traversal sequences. When a developer calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to the attacker-controlled path, creating parent directories as needed.

Critical Impact
An untrusted checked-out project can overwrite arbitrary files outside the project root with the privileges of the user running PraisonAI.

Affected Products

PraisonAI praisonaiagents pip package versions before 1.6.78
Python projects consuming PraisonAI as an agent framework dependency
Developer workstations and CI environments that clone untrusted repositories using PraisonAI

Discovery Timeline

2026-07-10 - CVE-2026-60089 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-60089

Vulnerability Analysis

PraisonAI is an agent framework used to build and orchestrate large language model (LLM) workflows. When an Agent object is constructed, the library searches the current working directory for a .praisonai/config.toml file and merges its defaults into the agent configuration. The defaults.output.output_file value determines where agent responses are persisted at runtime.

The library does not sanitize or constrain this path to the project root. A malicious repository can ship a .praisonai/config.toml that points output_file to sensitive locations such as ~/.ssh/authorized_keys, ~/.bashrc, or files under /etc when PraisonAI runs with sufficient privileges. When the developer executes agent.start() without supplying an explicit output argument, the LLM response content is written to the attacker-specified location, and any missing parent directories are silently created.

Root Cause

The root cause is missing input validation on a filesystem path sourced from a project-local, untrusted configuration file. The output_file value is passed directly to file-writing routines without normalization, allow-listing, or a check confirming the resolved path remains within the project directory.

Attack Vector

Exploitation requires a developer to clone or open a malicious repository containing a crafted .praisonai/config.toml and then run PraisonAI code that instantiates an Agent and calls agent.start() without an explicit output path. The attack is local, requires no authentication, and needs no user interaction beyond the normal development workflow. File overwrite occurs with the invoking user's privileges. See the GitHub Security Advisory GHSA-qjw5-xwrp-xwpq and the VulnCheck Advisory on Path Traversal for full technical details.

Detection Methods for CVE-2026-60089

Indicators of Compromise

Presence of a .praisonai/config.toml file in a repository containing output_file values with absolute paths or .. traversal sequences.
Unexpected file creations or overwrites in user home directories, dotfiles, or system paths shortly after PraisonAI execution.
Newly created parent directories outside the project root that coincide with PraisonAI process activity.

Detection Strategies

Scan repositories and developer workstations for .praisonai/config.toml files and inspect defaults.output.output_file values for suspicious paths.
Enumerate installed Python packages across build agents to identify praisonaiagents versions older than 1.6.78.
Correlate Python interpreter process events with file-write events targeting paths outside the current working directory.

Monitoring Recommendations

Monitor file integrity for sensitive user configuration files such as SSH keys, shell rc files, and cron entries on systems where PraisonAI runs.
Alert on process trees where Python invokes PraisonAI and subsequently writes to paths outside the repository checkout directory.
Track dependency manifest changes that add or upgrade praisonaiagents in CI pipelines.

How to Mitigate CVE-2026-60089

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.78 or later across all developer workstations, CI runners, and production images.
Audit existing repositories for .praisonai/config.toml files and remove or review any output_file entries containing absolute paths or .. sequences.
Run PraisonAI workloads under least-privilege accounts that cannot modify sensitive system or user files.

Patch Information

The issue is resolved in praisonaiagents1.6.78. The upstream fix is available in the GitHub Commit Update, which adds validation to constrain the output_file path within the project root when loaded from .praisonai/config.toml.

Workarounds

Always pass an explicit output parameter to agent.start() so the value from config.toml is not used.
Delete or ignore .praisonai/config.toml when working with untrusted repositories, or run PraisonAI in a sandboxed container with a read-only host filesystem.
Enforce a code review policy that blocks committing .praisonai/config.toml files containing absolute paths or traversal sequences.

bash

# Configuration example: upgrade the vulnerable package
pip install --upgrade 'praisonaiagents>=1.6.78'

# Verify installed version
pip show praisonaiagents | grep -i version

# Scan a workspace for risky config files before opening untrusted projects
grep -R --include='config.toml' -nE 'output_file\s*=\s*"(/|.*\.\.)' .