Praisonai EUVD-2026-21166

The CVSS score of 6.5 (Medium) with network vector (AV:N), low complexity (AC:L), and no privilege requirement (PR:N) reflects remote exploitability with minimal attacker effort. However, the vector includes UI:R (requires user interaction), indicating a user must pull a recipe bundle for the attack to succeed-this significantly reduces real-world risk in fully automated deployments. The EPSS score is not provided, limiting quantitative exploitation probability assessment. No CISA KEV status or public proof-of-concept code is documented in the supplied data, indicating this is not confirmed as actively exploited in the wild at the time of analysis. The availability impact (A:H) is the sole impact vector, limiting scope to denial of service rather than confidentiality or integrity compromise. Risk is moderate if users regularly pull untrusted recipe bundles; risk is low in organizations that curate internal recipe sources or run PraisonAI in isolated environments with quota enforcement. The fix version (4.5.128) is available, making remediation straightforward.

An attacker publishes a malicious recipe bundle to a public or internal recipe registry containing a highly compressible file (e.g., a 10GB archive of zeros compressed to approximately 10MB). When a developer or automated process executes LocalRegistry.pull() or HttpRegistry.pull() to fetch this recipe, the _safe_extractall() function extracts the archive without size validation, causing the system's disk to fill completely and triggering denial of service. No prior interaction or authentication is required beyond a user initiating the recipe pull operation, making this a low-friction attack against organizations that do not validate recipe sources. The user interaction requirement (UI:R in CVSS) means this is not remotely triggerable without user involvement, limiting automated exploitation scenarios.