CVE-2026-57113High· 8.1▾ TwilightPraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-control…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.
PraisonAI >= 2.6.0, < 4.6.59Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
praisonai >= 2.6.0, < 4.6.59Patched in:
praisonai 4.6.59Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57119High· 7.5PraisonAI is a multi-agent teams system
CVE-2026-56834High· 7.5PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
CVE-2026-56839High· 7.3PraisonAI is a multi-agent teams system
CVE-2026-57145Critical· 9.1PraisonAI is a multi-agent teams system
CVE-2026-56833High· 7.5PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
GHSA-f44v-7qgw-9gh9High· 8.1PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion