CVE-2026-60089 PraisonAI before 1.6.78 Path Traversal via config.toml
Attackers can overwrite arbitrary files via malicious config in untrusted projects, impacting developers using PraisonAI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-60089?
CVE-2026-60089 is a medium-severity path traversal vulnerability in MervinPraison PraisonAI, published on 10 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.
Weakness: CWE-22
Which versions are affected by CVE-2026-60089?
3 open source packages ship an affected version, including praisonaiagents.
| Package | Affected | Fixed in |
|---|---|---|
praisonaiagents PyPI | All versions | 1.6.78 |
praisonaiagents PyPI | All versions | 1.6.78 |
praisonaiagents PyPI | All versions | 1.6.78 |
How do I fix CVE-2026-60089?
Upgrade praisonaiagents to 1.6.78 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-60089 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-60089 exists.
Sources
Also known as CVE-2026-62163, GHSA-qjw5-xwrp-xwpq, PYSEC-2026-4273.