{"id":"CVE-2026-57113","kind":"vulnerability","aliases":["CVE-2026-57113"],"related":[],"title":"PraisonAI: crafted template ref lets attackers delete arbitrary directories","description":"PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.","summary":"PraisonAI's GitHub template loader stores the template path and ref without checking them, so a crafted ref such as `../` sequences escapes the template cache directory. When the matching cache folder already exists, the loader calls `shutil.rmtree` on an attacker-chosen outside path, deleting it.","severity":"high","cvss":8.1,"epss":0.00438,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","praisonai","python","self-hosted"],"not_affected_if":["no-github-template-loading","versions-4.6.59-or-later"],"how_to_check":"- Check the installed PraisonAI version; affected builds are `2.6.0` up to but not including `4.6.59`.\n- Search your code and configuration for `github:` template URIs passed to the PraisonAI template loader, especially ones that take user input.\n- Look for `~/.praison/cache/templates/github/` on hosts that load templates.","fix":"- Upgrade PraisonAI to `4.6.59` or later.\n- Until upgraded, do not pass untrusted template URIs with refs to the loader.","status":"open","published_at":"2026-10-23T13:17:10+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T03:04:39+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:04:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PraisonAI to `4.6.59` or later.\n- Until upgraded, do not pass untrusted template URIs with refs to the loader.","reach":"unknown","title":"PraisonAI: crafted template ref lets attackers delete arbitrary directories","impact":"high","summary":"PraisonAI's GitHub template loader stores the template path and ref without checking them, so a crafted ref such as `../` sequences escapes the template cache directory. When the matching cache folder already exists, the loader calls `shutil.rmtree` on an attacker-chosen outside path, deleting it.","category":"ai-tooling","nicknames":[],"who_cares":["praisonai","python","ai-agents","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker deletes arbitrary outside directories and writes files outside the cache.","analyst_note":"","how_to_check":"- Check the installed PraisonAI version; affected builds are `2.6.0` up to but not including `4.6.59`.\n- Search your code and configuration for `github:` template URIs passed to the PraisonAI template loader, especially ones that take user input.\n- Look for `~/.praison/cache/templates/github/` on hosts that load templates.","needs_analyst":false,"not_affected_if":["versions-4.6.59-or-later","no-github-template-loading"],"who_is_affected":"Teams running PraisonAI from `2.6.0` up to but not including `4.6.59` that load templates from GitHub URIs with refs, particularly where the URI or ref can come from outside input. Installs on `4.6.59` or later are patched, and installs that never load GitHub templates are unlikely to reach the flawed code path.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001071,"input_tokens":3508,"output_tokens":1440,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-57113':12A,15A '/../../../../../outside-delete-target':145C '/.praison/cache/templates/github':123C '2.6.0':82C '4.6.59':86C,201C 'accept':91C 'agent':18B,77C 'ai':17B,20B 'ai-ag':16B 'ai-tool':19B 'alreadi':58B,170C 'arbitrari':8A 'attack':6A,67B,184C 'attacker-chosen':66B 'attacker-select':183C 'cach':51B,56B,116C,138C,149C,159C,163C,178C,192C 'cache_meta.json':156C 'call':62B 'check':39B,129C 'chosen':68B 'control':108C 'craft':2A,43B,141C 'creat':172C 'cve':10A,13A 'delet':7A,71B 'directori':9A,52B,150C,187C 'escap':48B,147C 'exampl':98C 'exist':59B 'final':132C 'first':152C 'folder':57B 'github':29B,92C,99C 'hierarchi':164C 'host':26B 'insid':135C 'issu':195C 'join':119C 'later':118C 'layer':117C 'let':5A 'load':153C 'loader':31B,61B,90C 'match':55B 'metadata':193C 'multi':76C 'multi-ag':75C 'normal':125C,162C 'outsid':69B,157C,186C 'owner/repo/template':100C,168C 'patch':198C 'path':35B,70B,110C,133C,175C,179C 'praisonai':1A,22B,27B,72C,87C 'python':23B 'reach':176C 'ref':4A,37B,44B,96C,112C,142C 'remain':134C 'remov':181C 'replac':189C 'resolv':103C 'root':139C 'segment':127C 'select':185C 'self':25B 'self-host':24B 'sequenc':47B 'shutil.rmtree':63B,177C 'store':32B,104C 'system':79C 'team':78C 'templat':3A,30B,34B,50B,89C,93C,109C,137C 'therefor':146C 'tool':21B 'uri':94C 'user':107C 'user-control':106C 'v1.0.0':101C 'valu':121C 'verbatim':113C 'version':81C,85C,200C 'without':38B,124C 'write':155C","nicknames":[],"mitigations":[],"who_affected":"Teams running PraisonAI from `2.6.0` up to but not including `4.6.59` that load templates from GitHub URIs with refs, particularly where the URI or ref can come from outside input. Installs on `4.6.59` or later are patched, and installs that never load GitHub templates are unlikely to reach the flawed code path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57113","severity":null,"published_at":"2026-10-23T13:17:10+00:00","modified_at":"2026-10-23T15:17:33+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-57113","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57113","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}