CVE-2026-60089: PraisonAI: Project config can auto-save agent output outside the project root
praisonaiagents automatically reads project-local .praisonai/config.toml defaults when constructing an Agent. A repository-controlled config can set defaults.output.output_file to an absolute path or a .. traversal path. When the developer later calls agent.start(...), PraisonAI writes the agent response to that path with open(..., "w"), creating parent directories if needed.
This lets an untrusted project overwrite files outside the project root with the privileges of the user running PraisonAI.
References
- github.com/MervinPraison/PraisonAI/commit/3aa9cbc2bd49c23a32be0a89a5e620d13d843eab
- github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qjw5-xwrp-xwpq
- github.com/advisories/GHSA-qjw5-xwrp-xwpq
- nvd.nist.gov/vuln/detail/CVE-2026-60089
- www.vulncheck.com/advisories/praisonai-before-path-traversal-via-config-toml
Code Behaviors & Features
Detect and mitigate CVE-2026-60089 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →