PraisonAI CVE-2026-57113

Requires PraisonAI (>= 2.6.0, <= 4.6.57) configured to accept GitHub template sources - the advisory notes allow_any_github permits GitHub sources by default - and a user or automated service must be induced to load an attacker-supplied github: template URI whose ref contains traversal segments (e.g. @../../../../../../outside-target). The outside-cache .cache_meta.json write occurs on the first load; the more damaging shutil.rmtree directory deletion additionally requires that a normal cache entry for the same owner/repo/template prefix already exists. Impact is strictly bounded by the filesystem permissions of the PraisonAI process, and the CVSS UI:R reflects that nothing is triggered without the victim loading the malicious URI. Network access is not required for the write/delete primitive itself (the PoV disables networking entirely).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, base 8.1 High) describes a network-reachable, low-complexity, unauthenticated flaw gated only by user interaction, with no confidentiality loss but high integrity and availability impact - consistent with the described outside-cache file write and attacker-chosen directory deletion. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. There is no CISA KEV listing, so this is not confirmed as actively exploited; however the GHSA advisory publishes a working local-only PoV reproducer plus a release sweep confirming the bug across every tested tag (v2.6.0 through v4.6.57 and current head), so a public proof-of-concept clearly exists and the barrier to weaponization is low - but POC availability must not be conflated with active exploitation. No SSVC automatable/technical-impact decision fields were provided; the only prioritization signal is vuln.today's 'this_week' label, which maps to a real but non-emergency priority. Practical risk is moderated by two factors the raw score understates: exploitation requires the victim to load an attacker-supplied template URI (UI:R), and the destructive shutil.rmtree primitive additionally requires a pre-existing normal cache entry for the same owner/repo/template prefix - without it, impact is limited to a single .cache_meta.json write outside the cache. Net assessment: a genuine this-week-priority integrity/availability issue for PraisonAI users who load untrusted templates, not a drop-everything emergency, with no evidence of widespread or targeted exploitation in the provided data.

An attacker publishes or shares a PraisonAI GitHub template URI whose ref contains a path-traversal sequence (e.g. github:attacker/repo/template@../../../../../../target) and induces a user or automated service to load it. On first load the resolver writes .cache_meta.json outside the cache root, and if a normal cache entry for the same owner/repo/template already exists, a subsequent load reaches shutil.rmtree and deletes the attacker-chosen directory. The GHSA advisory includes a working local-only PoV that demonstrates both the outside-cache write and the directory deletion without any network access.