Live › vulnerability › CVE-2026-57113
Go to dashboardPraisonAI's GitHub template loader stores the template path and ref without checking them, so a crafted ref such as `../` sequences escapes the template cache directory. When the matching cache folder already exists, the loader calls `shutil.rmtree` on an attacker-chosen outside path, deleting it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running PraisonAI from up to but not including that load templates from GitHub URIs with refs, particularly where the URI or ref can come from outside input. Installs on or later are patched, and installs that never load GitHub templates are unlikely to reach the flawed code path.
2.6.04.6.594.6.59No product ranges from the sources yet.
2.6.0 up to but not including 4.6.59.github: template URIs passed to the PraisonAI template loader, especially ones that take user input.~/.praison/cache/templates/github/ on hosts that load templates.4.6.59 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.
This page as .md · .json · in your agent: get_signal("CVE-2026-57113")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.