CVE-2026-60088: PraisonAI Custom Command Templates Allow Unauthorized File Access
Summary
CVE-2026-60088: PraisonAI: Project custom command templates can read outside-workspace files into model prompts. Affects praisonai versions < 4.6.78. Fixed in 4.6.78. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PraisonAI is an open-source tool designed for AI-driven project management and automation. It allows users to create custom commands that can be executed within their projects. The tool features a file-based custom command system that auto-discovers commands from markdown files located in the '.praisonai/commands/' directory. This functionality is intended to enhance user experience by allowing project-specific commands to be easily defined and executed.
Vulnerability Detail
The vulnerability arises from PraisonAI's custom command feature, which allows project commands to read files outside the designated workspace. When users execute a command, the command body is interpolated, and file references are resolved relative to the current working directory. However, the interpolation process does not enforce containment checks, allowing attackers to exploit this feature by including references to files outside the project directory. This can lead to unauthorized access to sensitive information, as files such as 'outside_secret.txt' can be read and included in model prompts. The vulnerability is particularly concerning in untrusted repository workflows, where malicious actors could craft commands to exfiltrate sensitive data.
How To Fix
Latest published version: 4.7.16 as of 22 Oct 2026
pip install --upgrade "praisonai==4.7.16"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.6.78
This is the first release that contains the fix.
pip install --upgrade "praisonai==4.6.78"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid executing commands from untrusted repositories. It is advisable to manually review any custom command templates before execution to ensure they do not reference files outside the project directory.
Conclusion
CVE-2026-60088 is a significant vulnerability in PraisonAI that allows unauthorized file access through custom command templates. Users are urged to update to the patched version once available and to exercise caution when executing commands from untrusted repositories. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for praisonai →
FAQ
CVE-2026-60088 is a vulnerability in PraisonAI that allows custom command templates to read files outside the designated workspace, potentially exposing sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary risk is the unauthorized access to sensitive files outside the project directory, which could lead to data exfiltration and confidentiality breaches.
To mitigate risks, avoid executing commands from untrusted sources and ensure that custom command templates are reviewed for security before execution.
The CVSS score for CVE-2026-60088 is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for praisonai.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
