https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T08:29:57.912666+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-40157 CVE-2026-40157 — PraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack` 2026-10-17T08:29:57.914309+00:00

Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .praison tar archives using raw tar.extract() without validating archive member paths. A .praison bundle containing ../../ entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim's filesystem when they run praisonai recipe unpack. This vulnerability is fixed in 4.5.128.

 https://cve.radiocsirt.org/vuln/pysec-2026-469 PYSEC-2026-469 — PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack` 2026-10-17T08:29:57.914368+00:00

Affected: PyPI: praisonai

| Field | Value | |---|---| | Severity | Critical | | Type | Path traversal -- arbitrary file write via `tar.extract()` without member validation | | Affected | `src/praisonai/praisonai/cli/features/recipe.py:1170-1172` |

## Summary

`cmd_unpack` in the recipe CLI extracts `.praison` tar archives using raw `tar.extract()` without validating archive member paths. A `.praison` bundle containing `../../` entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim's filesystem when they run `praisonai recipe unpack`.

## Details

The vulnerable code is in `cli/features/recipe.py:1170-1172`:

```python for member in tar.getmembers(): if member.name != "manifest.json": tar.extract(member, recipe_dir) ```

The only check is whether the member is `manifest.json`. The code never validates member names -- absolute paths, `..` components, and symlinks all pass through. Python's `tarfile.extract()` resolves these relative to the destination, so a member named `../../.bashrc` lands two directories above `recipe_dir`.

The codebase does contain a safe extraction function (`_safe_extractall` in `recipe/registry.py:131-162`) that rejects absolute paths, `..` segments, and resolved paths outside the destination. It is used by the `pull` and `publish` paths, but `cmd_unpack` does not call it. ```python # recipe/registry.py:141-159 -- safe version exists but is not used by cmd_unpack…