CVE-2026-57113highBroken access control2026-10-23

CVE-2026-57113: A crafted PraisonAI GitHub template ref can delete folders outside the template cache

PraisonAI's template loader builds its cache path from the owner, repo, template and ref of a github: template URI without checking the result stays inside the cache. A ref like ../../../outside-target escapes it, writes a .cache_meta.json file elsewhere and, once a normal cache entry exists for the same template, deletes an attacker-chosen directory. Affects praisonai 2.6.0 through 4.6.57; fixed in 4.6.59.

01.

What it is

A URI such as github:owner/repo/[email protected] is parsed with broad regex groups, and the path and ref are later joined into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> with no normalization.

On the first load a crafted ref writes .cache_meta.json outside the cache. If the cache already holds that owner/repo/template, the same path reaches shutil.rmtree() and removes a directory the PraisonAI process can reach before writing cache metadata in its place.

No malicious archive or network access is needed, and GitHub sources are allowed by default. The attacker only has to get a user or service to load their template URI.

02.

How to check

Affected: praisonai (PyPI) 2.6.0 through 4.6.57.
You are at risk if your app, agent or CI loads PraisonAI templates from github: URIs that users or outside content can influence.

03.

How to fix

Upgrade praisonai to 4.6.59 or later.
Until then, only load templates from repos and refs you trust, and don't pass user-supplied template URIs straight to the loader.

pip show praisonai | grep -i version

04.

Sources

More advisories for this tool