https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 12:19:47 +0000 https://db.gcve.eu/vuln/cve-2026-60088 <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outside_secret.txt or absolute paths in project command files to exfiltrate process-readable files into model prompts.</p> <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outside_secret.txt or absolute paths in project command files to exfiltrate process-readable files into model prompts.</p> https://db.gcve.eu/vuln/cve-2026-60088 https://db.gcve.eu/vuln/pysec-2026-4261 <p><strong>Affected:</strong> PyPI: praisonai</p> <p># Project custom command templates can read outside-workspace files into model prompts</p> <p>## Summary</p> <p>PraisonAI&#39;s new file-based custom command feature auto-discovers project commands from `.praisonai/commands/*.md`. When a user runs `praisonai run --command &lt;name&gt;` inside a repository, the command body is interpolated before it is sent as the model prompt.</p> <p>The interpolation code expands `@path` references by reading files relative to the current working directory, but it does not canonicalize the target or require it to stay inside the project. A repository-controlled command can therefore include `@../outside_secret.txt` or an absolute path and cause PraisonAI to copy process-readable files outside the workspace into the prompt.</p> <p>This is a confidentiality issue in the untrusted-repository workflow: a project can make a normal-looking custom command exfiltrate local files to whichever model/provider receives the generated prompt.</p> <p>## Technical Details</p> <p>The feature was introduced by commit `88cf0c29` (`feat: file-based custom agents and reusable commands with auto-discovery (#2035)`) and is present on current main:</p> <p>```text current commit: 3aa9cbc2bd49c23a32be0a89a5e620d13d843eab current describe: v4.6.64-8-g3aa9cbc2 ```</p> <p>`src/praisonai/praisonai/cli/features/custom_definitions.py` discovers project-level definitions by walking upward from `Path.cwd()` to the git root and loading `.praisonai/commands/*.md`. Project commands override user-global commands.</p> <p>`interpolate_command…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p># Project custom command templates can read outside-workspace files into model prompts</p> <p>## Summary</p> <p>PraisonAI&#39;s new file-based custom command feature auto-discovers project commands from `.praisonai/commands/*.md`. When a user runs `praisonai run --command &lt;name&gt;` inside a repository, the command body is interpolated before it is sent as the model prompt.</p> <p>The interpolation code expands `@path` references by reading files relative to the current working directory, but it does not canonicalize the target or require it to stay inside the project. A repository-controlled command can therefore include `@../outside_secret.txt` or an absolute path and cause PraisonAI to copy process-readable files outside the workspace into the prompt.</p> <p>This is a confidentiality issue in the untrusted-repository workflow: a project can make a normal-looking custom command exfiltrate local files to whichever model/provider receives the generated prompt.</p> <p>## Technical Details</p> <p>The feature was introduced by commit `88cf0c29` (`feat: file-based custom agents and reusable commands with auto-discovery (#2035)`) and is present on current main:</p> <p>```text current commit: 3aa9cbc2bd49c23a32be0a89a5e620d13d843eab current describe: v4.6.64-8-g3aa9cbc2 ```</p> <p>`src/praisonai/praisonai/cli/features/custom_definitions.py` discovers project-level definitions by walking upward from `Path.cwd()` to the git root and loading `.praisonai/commands/*.md`. Project commands override user-global commands.</p> <p>`interpolate_command…</p> https://db.gcve.eu/vuln/pysec-2026-4261