Is CVE-2026-57119 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57119 being exploited in the wild.

How severe is CVE-2026-57119?

High severity, with a CVSS score of 7.5, published 14 September 2026.

Which products and versions are affected?

praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.59.

Is there a fix for CVE-2026-57119?

Yes. praisonai (PyPI): upgrade to 4.6.59 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57119 attacked?

It is attacked over the network.

Am I affected by CVE-2026-57119?

Check whether you run praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57119: PraisonAI Jobs API path traversal

CVE-2026-57119 · Severity: high · CVSS 7.5 · Published 2026-09-14

PraisonAI is a multi-agent AI system for coordinating automated tasks. An unauthenticated attacker can exploit a path traversal vulnerability in the Jobs API to read arbitrary files on the server, potentially exposing credentials, API keys, environment variables, and other sensitive data accessible to the service account. This allows an attacker to compromise the entire system and pivot to connected infrastructure.

Technologies: praisonai (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-57119 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57119 being exploited in the wild.
How severe is CVE-2026-57119?: High severity, with a CVSS score of 7.5, published 14 September 2026.
Which products and versions are affected?: praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.59.
Is there a fix for CVE-2026-57119?: Yes. praisonai (PyPI): upgrade to 4.6.59 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57119 attacked?: It is attacked over the network.
Am I affected by CVE-2026-57119?: Check whether you run praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonai (PyPI): upgrade to 4.6.59 or later
```
pip install "praisonai>=4.6.59"
```

Technical details

The vulnerability is a path traversal (CWE-22) in the POST /api/v1/runs endpoint. The unauthenticated Jobs API accepts an absolute or traversing agent_file path parameter without validating it against a workspace allowlist or boundary check. This path is then passed unsanitized to the job executor, which opens and processes the file with the privileges of the service account. An attacker can use path traversal sequences (../) or absolute paths to read sensitive files outside the intended workspace directory. The vulnerability is fixed in version 4.6.59 through input validation hardening and access controls.

Affected products

PraisonAI PraisonAI before 4.6.59

Identifiers

CVE-2026-57119
GHSA-p4pj-vh7h-6cqh
PYSEC-2026-3516

Timeline

2026-06-13: patched: Fix committed with hardened input validation and access controls
2026-09-14: disclosed: CVE-2026-57119 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.