https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:54:53 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44340 <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member&#39;s name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(dest_dir) without filter=&#34;data&#34;. A bundle that contains a symlink with a name inside dest_dir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes dest_dir and lets the attacker write arbitrary content to an attacker-chosen location on the victim&#39;s filesystem. This issue has been patched in version 4.6.37.</p> <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member&#39;s name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(dest_dir) without filter=&#34;data&#34;. A bundle that contains a symlink with a name inside dest_dir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes dest_dir and lets the attacker write arbitrary content to an attacker-chosen location on the victim&#39;s filesystem. This issue has been patched in version 4.6.37.</p> https://cve.radiocsirt.org/vuln/cve-2026-44340 https://cve.radiocsirt.org/vuln/ghsa-9q28-ghcr-c4x3 <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>### Summary The `_safe_extractall` helper that all `recipe pull`, `recipe publish`, and `recipe unpack` flows route through validates each archive member&#39;s `name` for absolute paths, `..` segments, and resolved-path escape — but does **not** validate `member.linkname`, does not reject symlink/hardlink members, and calls `tar.extractall(dest_dir)` without `filter=&#34;data&#34;`. A bundle that contains a symlink with a name inside `dest_dir` but a `linkname` pointing outside it, followed by a regular file whose path traverses *through* the just-created symlink, escapes `dest_dir` and lets the attacker write arbitrary content to an attacker-chosen location on the victim&#39;s filesystem.</p> <p>## Affected paths</p> <p>Every code path that calls `_safe_extractall` is exposed:</p> <p>| Caller | File:line | |---|---| | `praisonai recipe unpack` | `src/praisonai/praisonai/cli/features/recipe.py:1175` (introduced as the fix for GHSA-99g3-w8gr-x37c) | | `LocalRegistry.unpack` (recipe pull) | `src/praisonai/praisonai/recipe/registry.py:413` | | Registry archive validation (publish) | `src/praisonai/praisonai/recipe/registry.py:808` |</p> <p>## Root cause</p> <p>`recipe/registry.py:131-178`:</p> <p>```python def _safe_extractall(tar: tarfile.TarFile, dest_dir: Path) -&gt; None: ... for member in tar.getmembers(): ... member_path = Path(member.name) if member_path.is_absolute(): raise RegistryError(...) if &#39;..&#39; in member_path.parts: raise RegistryError(...) resolved = (dest_resolved / me…</p> <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>### Summary The `_safe_extractall` helper that all `recipe pull`, `recipe publish`, and `recipe unpack` flows route through validates each archive member&#39;s `name` for absolute paths, `..` segments, and resolved-path escape — but does **not** validate `member.linkname`, does not reject symlink/hardlink members, and calls `tar.extractall(dest_dir)` without `filter=&#34;data&#34;`. A bundle that contains a symlink with a name inside `dest_dir` but a `linkname` pointing outside it, followed by a regular file whose path traverses *through* the just-created symlink, escapes `dest_dir` and lets the attacker write arbitrary content to an attacker-chosen location on the victim&#39;s filesystem.</p> <p>## Affected paths</p> <p>Every code path that calls `_safe_extractall` is exposed:</p> <p>| Caller | File:line | |---|---| | `praisonai recipe unpack` | `src/praisonai/praisonai/cli/features/recipe.py:1175` (introduced as the fix for GHSA-99g3-w8gr-x37c) | | `LocalRegistry.unpack` (recipe pull) | `src/praisonai/praisonai/recipe/registry.py:413` | | Registry archive validation (publish) | `src/praisonai/praisonai/recipe/registry.py:808` |</p> <p>## Root cause</p> <p>`recipe/registry.py:131-178`:</p> <p>```python def _safe_extractall(tar: tarfile.TarFile, dest_dir: Path) -&gt; None: ... for member in tar.getmembers(): ... member_path = Path(member.name) if member_path.is_absolute(): raise RegistryError(...) if &#39;..&#39; in member_path.parts: raise RegistryError(...) resolved = (dest_resolved / me…</p> https://cve.radiocsirt.org/vuln/ghsa-9q28-ghcr-c4x3