PraisonAI CVE-2026-60089

The attacker must control a repository cloned by the victim, and that repository must contain a .praisonai/config.toml file with defaults.output.output_file set to an absolute path (e.g., /home/user/.bashrc) or a directory traversal sequence (e.g., ../../sensitive-file). The victim must construct a PraisonAI Agent object while in or referencing that project directory, and must call agent.start() without explicitly supplying an output parameter - callers that pass output directly are not affected. Exploitation is bounded by the filesystem permissions of the user running PraisonAI; overwriting system-owned files requires the process to run as root, which is not a default condition. The attack does not require any network access to a PraisonAI service, any account or credentials on the victim system, or installation of a malicious Python package - only that the victim clones and invokes a PraisonAI-based project from an untrusted source.

The vendor-assigned CVSS 4.0 score of 6.9 and local attack vector (AV:L) accurately reflect the supply-chain nature of this flaw - the attacker's 'access' is limited to pushing a malicious config into a repository that a developer then clones and uses. However, the vendor's CVSS 4.0 impact metrics (VC:H/VI:N/VA:N) appear inconsistent with the described impact: the vulnerability's primary effect is writing arbitrary content to attacker-chosen paths, which is a high-integrity violation (VI should be H, not N); the VC:H rating is not supported by the provided description and likely reflects a scoring error - security teams should treat this as a high-integrity-impact flaw rather than a confidentiality one. No EPSS score or CISA KEV listing is present in the available intelligence, so neither exploitation probability nor confirmed active exploitation can be quantified. AC:L and AT:N correctly indicate that no race condition or specialized configuration is needed beyond the cloned repository containing the malicious config file. The practical risk is concentrated among developers and CI/CD pipelines that clone and execute PraisonAI projects from untrusted or lightly-reviewed sources; organizations that build internal tooling on top of PraisonAI and process community-contributed agent projects are the highest-risk cohort.

An attacker publishes a public AI agent project repository containing a .praisonai/config.toml that sets defaults.output.output_file to ../../.ssh/authorized_keys. A developer clones the repository to experiment with the agent prompts and runs the provided example script, which constructs an Agent and calls agent.start() without specifying an output parameter; PraisonAI silently resolves the traversal path and overwrites the developer's SSH authorized keys with the LLM-generated agent response, enabling subsequent attacker SSH access if the attacker's key is embedded in the agent prompt. No public exploit code has been identified, but the attack is trivially reproducible from the public advisory description alone.