---
id: "CVE-2026-57113"
kind: "vulnerability"
aliases: ["CVE-2026-57113"]
title: "PraisonAI: crafted template ref lets attackers delete arbitrary directories"
severity: "high"
cvss: 8.1
epss: 0.00438
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "praisonai", "python", "self-hosted"]
not_affected_if: ["no-github-template-loading", "versions-4.6.59-or-later"]
published_at: "2026-10-23T13:17:10+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57113", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-57113", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# PraisonAI: crafted template ref lets attackers delete arbitrary directories

PraisonAI's GitHub template loader stores the template path and ref without checking them, so a crafted ref such as `../` sequences escapes the template cache directory. When the matching cache folder already exists, the loader calls `shutil.rmtree` on an attacker-chosen outside path, deleting it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PraisonAI version; affected builds are `2.6.0` up to but not including `4.6.59`.
- Search your code and configuration for `github:` template URIs passed to the PraisonAI template loader, especially ones that take user input.
- Look for `~/.praison/cache/templates/github/` on hosts that load templates.

## Fix

- Upgrade PraisonAI to `4.6.59` or later.
- Until upgraded, do not pass untrusted template URIs with refs to the loader.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57113
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-57113

## From the sources

PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_