pwnflow

Pwnflow 🎯 Visualize Your Security Testing & Analysis Journey Pwnflow is a mind-mapping platform designed specifically for cybersecurity professionals. it helps you visualize, track, and share your security testing methodologies while maintaining complete control over your sensitive data. 🚀 Key...

PYSEC-2026-4261 PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...

EUVD-2026-43174

PraisonAI: Project custom command templates can read outside-workspace files into model prompts...

GHSA-XPX6-X8C2-MW5W PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...

GHSA-WGVQ-3JXH-4QG7 Duplicate Advisory: PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xpx6-x8c2-mw5w. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to rea...

Directory Traversal

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

CVE-2026-60088

CVE-2026-60088 affects PraisonAI prior to 4.6.78. The issue is a path traversal flaw in custom command templates, where file paths are not validated, allowing an attacker to read files outside the workspace (e.g., @../outside_secret.txt or absolute paths) and exfiltrate process-readable files int...

CVE-2026-60088 PraisonAI before 4.6.78 Path Traversal via Custom Commands

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outsidesecret.txt or absolute paths in project command files to exfiltrate process-readable...

CVE-2026-60088: Improper Limitation of a Pathname to a Restricted Directory

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outsidesecret.txt or absolute paths in project command files to exfiltrate process-readable...

PT-2026-57432

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78 Description The software fails to validate file path references within custom command templates. This allows attackers to read files outside the designated workspace by using absolute paths or path traversal...

CVE-2026-32608 Glances has a Command Injection via Process Names in Action Command Templates

Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables e.g., name, key that are populated with runtime...