PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.

Affected: PyPI: praisonai

## Summary

PraisonAI's template loader accepts GitHub template URIs with refs, for example `github:owner/repo/template@v1.0.0`. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into `~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref>` without normalizing each segment or checking that the final path remains inside the template cache root.

A crafted ref such as `../../../../../../outside-delete-target` therefore escapes the cache directory. The first load can write `.cache_meta.json` outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches `shutil.rmtree(cache_path)` and removes an attacker-selected outside directory before replacing it with cache metadata.

This is distinct from the old template Zip Slip advisory. No malicious archive member is needed, and the PoV disables network access entirely. The bug is in cache-key construction for GitHub template URIs.

## Affected versions

Confirmed vulnerable:

- `v2.6.0` - `v3.9.24` - `v3.9.26` - `v4.5.126` - `v4.5.128` - `v4.6.9` - `v4.6.10` - `v4.6.56` - `v4.6.57` - current head `2f9677abb2ea68eab864ee8b6a828fd0141612e1`

Recommended affected range: `>= 2.6.0, <= 4.6.57`.

No fixed version is known at the time of this report.

## Impact

An attacker who can cause a user or service to load an attacker-supplied PraisonAI GitHub template URI can:

- create `.cache_meta.json` ou…

Affected: PyPI: praisonai

## Summary

PraisonAI's template loader accepts GitHub template URIs with refs, for example `github:owner/repo/template@v1.0.0`. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into `~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref>` without normalizing each segment or checking that the final path remains inside the template cache root.

A crafted ref such as `../../../../../../outside-delete-target` therefore escapes the cache directory. The first load can write `.cache_meta.json` outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches `shutil.rmtree(cache_path)` and removes an attacker-selected outside directory before replacing it with cache metadata.

This is distinct from the old template Zip Slip advisory. No malicious archive member is needed, and the PoV disables network access entirely. The bug is in cache-key construction for GitHub template URIs.

## Affected versions

Confirmed vulnerable:

- `v2.6.0` - `v3.9.24` - `v3.9.26` - `v4.5.126` - `v4.5.128` - `v4.6.9` - `v4.6.10` - `v4.6.56` - `v4.6.57` - current head `2f9677abb2ea68eab864ee8b6a828fd0141612e1`

Recommended affected range: `>= 2.6.0, <= 4.6.57`.

No fixed version is known at the time of this report.

## Impact

An attacker who can cause a user or service to load an attacker-supplied PraisonAI GitHub template URI can:

- create `.cache_meta.json` ou…