https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 11:35:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291181 EUVD-2026-291181 https://cve.radiocsirt.org/vuln/euvd-2026-291181 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40157 <p>PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .praison tar archives using raw tar.extract() without validating archive member paths. A .praison bundle containing ../../ entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim&#39;s filesystem when they run praisonai recipe unpack. This vulnerability is fixed in 4.5.128.</p> <p>PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .praison tar archives using raw tar.extract() without validating archive member paths. A .praison bundle containing ../../ entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim&#39;s filesystem when they run praisonai recipe unpack. This vulnerability is fixed in 4.5.128.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40157 https://cve.radiocsirt.org/vuln/ghsa-99g3-w8gr-x37c <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>| Field | Value | |---|---| | Severity | Critical | | Type | Path traversal -- arbitrary file write via `tar.extract()` without member validation | | Affected | `src/praisonai/praisonai/cli/features/recipe.py:1170-1172` |</p> <p>## Summary</p> <p>`cmd_unpack` in the recipe CLI extracts `.praison` tar archives using raw `tar.extract()` without validating archive member paths. A `.praison` bundle containing `../../` entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim&#39;s filesystem when they run `praisonai recipe unpack`.</p> <p>## Details</p> <p>The vulnerable code is in `cli/features/recipe.py:1170-1172`:</p> <p>```python for member in tar.getmembers(): if member.name != &#34;manifest.json&#34;: tar.extract(member, recipe_dir) ```</p> <p>The only check is whether the member is `manifest.json`. The code never validates member names -- absolute paths, `..` components, and symlinks all pass through. Python&#39;s `tarfile.extract()` resolves these relative to the destination, so a member named `../../.bashrc` lands two directories above `recipe_dir`.</p> <p>The codebase does contain a safe extraction function (`_safe_extractall` in `recipe/registry.py:131-162`) that rejects absolute paths, `..` segments, and resolved paths outside the destination. It is used by the `pull` and `publish` paths, but `cmd_unpack` does not call it.</p> <p>```python # recipe/registry.py:141-159 -- safe version exists but is not used by cmd_unpack de…</p> <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>| Field | Value | |---|---| | Severity | Critical | | Type | Path traversal -- arbitrary file write via `tar.extract()` without member validation | | Affected | `src/praisonai/praisonai/cli/features/recipe.py:1170-1172` |</p> <p>## Summary</p> <p>`cmd_unpack` in the recipe CLI extracts `.praison` tar archives using raw `tar.extract()` without validating archive member paths. A `.praison` bundle containing `../../` entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim&#39;s filesystem when they run `praisonai recipe unpack`.</p> <p>## Details</p> <p>The vulnerable code is in `cli/features/recipe.py:1170-1172`:</p> <p>```python for member in tar.getmembers(): if member.name != &#34;manifest.json&#34;: tar.extract(member, recipe_dir) ```</p> <p>The only check is whether the member is `manifest.json`. The code never validates member names -- absolute paths, `..` components, and symlinks all pass through. Python&#39;s `tarfile.extract()` resolves these relative to the destination, so a member named `../../.bashrc` lands two directories above `recipe_dir`.</p> <p>The codebase does contain a safe extraction function (`_safe_extractall` in `recipe/registry.py:131-162`) that rejects absolute paths, `..` segments, and resolved paths outside the destination. It is used by the `pull` and `publish` paths, but `cmd_unpack` does not call it.</p> <p>```python # recipe/registry.py:141-159 -- safe version exists but is not used by cmd_unpack de…</p> https://cve.radiocsirt.org/vuln/ghsa-99g3-w8gr-x37c https://cve.radiocsirt.org/vuln/pysec-2026-469 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>| Field | Value | |---|---| | Severity | Critical | | Type | Path traversal -- arbitrary file write via `tar.extract()` without member validation | | Affected | `src/praisonai/praisonai/cli/features/recipe.py:1170-1172` |</p> <p>## Summary</p> <p>`cmd_unpack` in the recipe CLI extracts `.praison` tar archives using raw `tar.extract()` without validating archive member paths. A `.praison` bundle containing `../../` entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim&#39;s filesystem when they run `praisonai recipe unpack`.</p> <p>## Details</p> <p>The vulnerable code is in `cli/features/recipe.py:1170-1172`:</p> <p>```python for member in tar.getmembers(): if member.name != &#34;manifest.json&#34;: tar.extract(member, recipe_dir) ```</p> <p>The only check is whether the member is `manifest.json`. The code never validates member names -- absolute paths, `..` components, and symlinks all pass through. Python&#39;s `tarfile.extract()` resolves these relative to the destination, so a member named `../../.bashrc` lands two directories above `recipe_dir`.</p> <p>The codebase does contain a safe extraction function (`_safe_extractall` in `recipe/registry.py:131-162`) that rejects absolute paths, `..` segments, and resolved paths outside the destination. It is used by the `pull` and `publish` paths, but `cmd_unpack` does not call it. ```python # recipe/registry.py:141-159 -- safe version exists but is not used by cmd_unpack…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>| Field | Value | |---|---| | Severity | Critical | | Type | Path traversal -- arbitrary file write via `tar.extract()` without member validation | | Affected | `src/praisonai/praisonai/cli/features/recipe.py:1170-1172` |</p> <p>## Summary</p> <p>`cmd_unpack` in the recipe CLI extracts `.praison` tar archives using raw `tar.extract()` without validating archive member paths. A `.praison` bundle containing `../../` entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim&#39;s filesystem when they run `praisonai recipe unpack`.</p> <p>## Details</p> <p>The vulnerable code is in `cli/features/recipe.py:1170-1172`:</p> <p>```python for member in tar.getmembers(): if member.name != &#34;manifest.json&#34;: tar.extract(member, recipe_dir) ```</p> <p>The only check is whether the member is `manifest.json`. The code never validates member names -- absolute paths, `..` components, and symlinks all pass through. Python&#39;s `tarfile.extract()` resolves these relative to the destination, so a member named `../../.bashrc` lands two directories above `recipe_dir`.</p> <p>The codebase does contain a safe extraction function (`_safe_extractall` in `recipe/registry.py:131-162`) that rejects absolute paths, `..` segments, and resolved paths outside the destination. It is used by the `pull` and `publish` paths, but `cmd_unpack` does not call it. ```python # recipe/registry.py:141-159 -- safe version exists but is not used by cmd_unpack…</p> https://cve.radiocsirt.org/vuln/pysec-2026-469