MervinPraison PraisonAI path traversal in GitHub template cache

Executive brief

PraisonAI, a framework for managing multi-agent AI systems, contains a vulnerability in how it handles GitHub-based templates. An attacker can provide a specially crafted template link that tricks the system into writing or deleting files outside of its intended storage area. This could lead to the loss of important application data, corruption of user configurations, or system instability.

Technical details

A path traversal vulnerability exists in PraisonAI's template loading mechanism due to insufficient validation of GitHub template URIs. The `TemplateCache` component constructs filesystem paths by joining user-controlled segments (owner, repo, path, and ref) without normalization or boundary checks. An attacker can use '..' sequences in the 'ref' portion of a URI (e.g., github:owner/repo/template@../../target) to escape the template cache directory. This allows for arbitrary file writes (specifically .cache_meta.json) and directory deletion via `shutil.rmtree()` when the cache is updated. The vulnerability is present in the template resolver and registry components and was introduced in version 2.6.0.

Affected products

• MervinPraison praisonai >= 2.6.0, <= 4.6.57

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D