CVE-2026-60089

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.

Project config can auto-save agent output outside the project root

Summary

praisonaiagents automatically reads project-local .praisonai/config.toml defaults when constructing an Agent. A repository-controlled config can set defaults.output.output_file to an absolute path or a .. traversal path. When the developer later calls agent.start(...), PraisonAI writes the agent response to that path with open(..., "w"), creating parent directories if needed.

This lets an untrusted project overwrite files outside the project root with the privileges of the user running PraisonAI.

Technical Details

The source-to-sink path is Agent.__init__() project config loading to OutputConfig.output_file to public agent.start() output auto-save. praisonaiagents/agent/agent.py applies config-driven defaults before parameter resolution; if the caller did not explicitly pass output, it calls apply_config_defaults("output", output, OutputConfig). praisonaiagents/config/loader.py treats a config block with enabled = true as active and instantiates OutputConfig from the remaining keys. OutputConfig includes output_file, and the agent stores that value as self._output_file.

After agent.start(...) obtains a truthy result from self.chat(...), praisonaiagents/agent/execution_mixin.py calls _save_output_to_file(str(result)) when self._output_file is set. praisonaiagents/agent/memory_mixin.py then runs expanduser() and abspath(), creates parent directories, and writes the destination with mode w. It does not constrain the resolved path to the current project, reject absolute paths, reject .., or distinguish an output path explicitly chosen by trusted application code from one loaded out of a project-local config file.

This is not a claim that explicit Agent(output=OutputConfig(output_file=...)) chosen by trusted application code is unsafe by itself. The security boundary crossed here is the automatically consumed project-local config file: a checked-out project can steer the write destination without the application code opting into that path.

PoV

Create a project containing:

[defaults.output]
enabled = true
output_file = "../victim-outside-project/agent-output.txt"

Then run ordinary agent code from inside that project without passing an explicit output parameter. The resolved output path escapes the project root, and PraisonAI writes the agent response there after agent.start(...).

I verified this locally without any external model call by replacing agent.chat with a deterministic offline stub after constructing the real Agent; the public start() method still performed the auto-save. Current-head output:

{
  "configured_output_file": "../victim-outside-project/agent-output.txt",
  "escaped_project_root": true,
  "source_head": "3aa9cbc2bd49c23a32be0a89a5e620d13d843eab",
  "start_returned": true,
  "canary_written": true
}

Negative controls:

[
  {
    "case": "safe-relative",
    "configured_output_file": "inside-output.txt",
    "expected_file_escaped_project": false,
    "expected_file_exists": true,
    "observed_files": {
      "project/inside-output.txt": "PRAISONAI_NEGATIVE_CONTROL_safe-relative\n"
    },
    "outside_files": [],
    "start_returned": true
  },
  {
    "case": "disabled-output",
    "configured_output_file": null,
    "expected_file_escaped_project": null,
    "expected_file_exists": false,
    "observed_files": {},
    "outside_files": [],
    "start_returned": true
  }
]

The first control shows a safe relative output path stays inside the project. The second control shows a traversal output_file is not applied when defaults.output.enabled is false.

PoC

#!/usr/bin/env python3
import os
import shutil
from pathlib import Path

from praisonaiagents import Agent
from praisonaiagents.config.loader import clear_config_cache

work = Path("praison-outputfile-poc").resolve()
project = work /…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-qjw5-xwrp-xwpq. This link is maintained to preserve external references.

Original Description

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.

Project config can auto-save agent output outside the project root

Summary

praisonaiagents automatically reads project-local .praisonai/config.toml defaults when constructing an Agent. A repository-controlled config can set defaults.output.output_file to an absolute path or a .. traversal path. When the developer later calls agent.start(...), PraisonAI writes the agent response to that path with open(..., "w"), creating parent directories if needed.

This lets an untrusted project overwrite files outside the project root with the privileges of the user running PraisonAI.

Technical Details

The source-to-sink path is Agent.__init__() project config loading to OutputConfig.output_file to public agent.start() output auto-save. praisonaiagents/agent/agent.py applies config-driven defaults before parameter resolution; if the caller did not explicitly pass output, it calls apply_config_defaults("output", output, OutputConfig). praisonaiagents/config/loader.py treats a config block with enabled = true as active and instantiates OutputConfig from the remaining keys. OutputConfig includes output_file, and the agent stores that value as self._output_file.

After agent.start(...) obtains a truthy result from self.chat(...), praisonaiagents/agent/execution_mixin.py calls _save_output_to_file(str(result)) when self._output_file is set. praisonaiagents/agent/memory_mixin.py then runs expanduser() and abspath(), creates parent directories, and writes the destination with mode w. It does not constrain the resolved path to the current project, reject absolute paths, reject .., or distinguish an output path explicitly chosen by trusted application code from one loaded out of a project-local config file.

This is not a claim that explicit Agent(output=OutputConfig(output_file=...)) chosen by trusted application code is unsafe by itself. The security boundary crossed here is the automatically consumed project-local config file: a checked-out project can steer the write destination without the application code opting into that path.

PoV

Create a project containing:

[defaults.output]
enabled = true
output_file = "../victim-outside-project/agent-output.txt"

Then run ordinary agent code from inside that project without passing an explicit output parameter. The resolved output path escapes the project root, and PraisonAI writes the agent response there after agent.start(...).

I verified this locally without any external model call by replacing agent.chat with a deterministic offline stub after constructing the real Agent; the public start() method still performed the auto-save. Current-head output:

{
  "configured_output_file": "../victim-outside-project/agent-output.txt",
  "escaped_project_root": true,
  "source_head": "3aa9cbc2bd49c23a32be0a89a5e620d13d843eab",
  "start_returned": true,
  "canary_written": true
}

Negative controls:

[
  {
    "case": "safe-relative",
    "configured_output_file": "inside-output.txt",
    "expected_file_escaped_project": false,
    "expected_file_exists": true,
    "observed_files": {
      "project/inside-output.txt": "PRAISONAI_NEGATIVE_CONTROL_safe-relative\n"
    },
    "outside_files": [],
    "start_returned": true
  },
  {
    "case": "disabled-output",
    "configured_output_file": null,
    "expected_file_escaped_project": null,
    "expected_file_exists": false,
    "observed_files": {},
    "outside_files": [],
    "start_returned": true
  }
]

The first control shows a safe relative output path stays inside the project. The second control shows a traversal output_file is not applied when defaults.output.enabled is false.

PoC

#!/usr/bin/env python3
import os
import shutil
from pathlib import Path

from praisonaiagents import Agent
from praisonaiagents.config.loader import clear_config_cache

work = Path("praison-outputfile-poc").resolve()
project = work /…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-qjw5-xwrp-xwpq. This link is maintained to preserve external references.

Original Description

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.output_file path. A repository-controlled config file can set output_file to an absolute or '..' traversal path; when the developer subsequently calls agent.start() without explicitly passing an output parameter, PraisonAI writes the agent response to that path (creating parent directories as needed), allowing an untrusted checked-out project to overwrite files outside the project root with the privileges of the user running PraisonAI.

Project config can auto-save agent output outside the project root

Summary

praisonaiagents automatically reads project-local .praisonai/config.toml defaults when constructing an Agent. A repository-controlled config can set defaults.output.output_file to an absolute path or a .. traversal path. When the developer later calls agent.start(...), PraisonAI writes the agent response to that path with open(..., "w"), creating parent directories if needed.

This lets an untrusted project overwrite files outside the project root with the privileges of the user running PraisonAI.

Technical Details

The source-to-sink path is Agent.__init__() project config loading to OutputConfig.output_file to public agent.start() output auto-save. praisonaiagents/agent/agent.py applies config-driven defaults before parameter resolution; if the caller did not explicitly pass output, it calls apply_config_defaults("output", output, OutputConfig). praisonaiagents/config/loader.py treats a config block with enabled = true as active and instantiates OutputConfig from the remaining keys. OutputConfig includes output_file, and the agent stores that value as self._output_file.

After agent.start(...) obtains a truthy result from self.chat(...), praisonaiagents/agent/execution_mixin.py calls _save_output_to_file(str(result)) when self._output_file is set. praisonaiagents/agent/memory_mixin.py then runs expanduser() and abspath(), creates parent directories, and writes the destination with mode w. It does not constrain the resolved path to the current project, reject absolute paths, reject .., or distinguish an output path explicitly chosen by trusted application code from one loaded out of a project-local config file.

This is not a claim that explicit Agent(output=OutputConfig(output_file=...)) chosen by trusted application code is unsafe by itself. The security boundary crossed here is the automatically consumed project-local config file: a checked-out project can steer the write destination without the application code opting into that path.

PoV

Create a project containing:

[defaults.output]
enabled = true
output_file = "../victim-outside-project/agent-output.txt"

Then run ordinary agent code from inside that project without passing an explicit output parameter. The resolved output path escapes the project root, and PraisonAI writes the agent response there after agent.start(...).

I verified this locally without any external model call by replacing agent.chat with a deterministic offline stub after constructing the real Agent; the public start() method still performed the auto-save. Current-head output:

{
  "configured_output_file": "../victim-outside-project/agent-output.txt",
  "escaped_project_root": true,
  "source_head": "3aa9cbc2bd49c23a32be0a89a5e620d13d843eab",
  "start_returned": true,
  "canary_written": true
}

Negative controls:

[
  {
    "case": "safe-relative",
    "configured_output_file": "inside-output.txt",
    "expected_file_escaped_project": false,
    "expected_file_exists": true,
    "observed_files": {
      "project/inside-output.txt": "PRAISONAI_NEGATIVE_CONTROL_safe-relative\n"
    },
    "outside_files": [],
    "start_returned": true
  },
  {
    "case": "disabled-output",
    "configured_output_file": null,
    "expected_file_escaped_project": null,
    "expected_file_exists": false,
    "observed_files": {},
    "outside_files": [],
    "start_returned": true
  }
]

The first control shows a safe relative output path stays inside the project. The second control shows a traversal output_file is not applied when defaults.output.enabled is false.

PoC

#!/usr/bin/env python3
import os
import shutil
from pathlib import Path

from praisonaiagents import Agent
from praisonaiagents.config.loader import clear_config_cache

work = Path("praison-outputfile-poc").resolve()
project = work /…