EUVD-2026-21166
GHSA-f2h6-7xfr-xm8w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the _safe_extractall() function in PraisonAI's recipe registry validates archive members against path traversal attacks but performs no checks on individual member sizes, cumulative extracted size, or member count before calling tar.extractall(). An attacker can publish a malicious recipe bundle containing highly compressible data (e.g., 10GB of zeros compressing to ~10MB) that exhausts the victim's disk when pulled via LocalRegistry.pull() or HttpRegistry.pull(). This vulnerability is fixed in 4.5.128.
AnalysisAI
Disk exhaustion in PraisonAI prior to 4.5.128 allows remote attackers to consume arbitrary disk space by publishing malicious recipe bundles containing highly compressible data that expand dramatically during extraction. The vulnerability exists in the _safe_extractall() function, which validates only path traversal attacks but lacks checks on individual member sizes, cumulative extracted size, or member count before tar extraction, enabling an unauthenticated attacker to trigger denial of service via LocalRegistry.pull() or HttpRegistry.pull() with minimal user interaction.
Technical ContextAI
PraisonAI is a multi-agent systems framework that uses a recipe registry mechanism to distribute and pull agent configurations and dependencies. The vulnerability resides in the archive extraction logic used by both LocalRegistry and HttpRegistry pull operations. The _safe_extractall() function implements partial validation by checking archive members against path traversal patterns (e.g., directory escape via ../ sequences), but omits critical resource consumption controls. When tar.extractall() is invoked on a crafted archive, no limits prevent decompression bombs-highly compressed files (e.g., 10GB of repetitive zero bytes compressed to ~10MB) that expand to their full size on extraction. This is a classic CWE-409 (Improper Resource Validation) issue where the application consumes resources without enforcing quotas or size thresholds. The affected CPE (mervinpraison:praisonai) indicates this affects the open-source PraisonAI package across all versions prior to 4.5.128.
RemediationAI
Vendor-released patch: Upgrade PraisonAI to version 4.5.128 or later, which implements resource validation checks in the _safe_extractall() function to enforce limits on individual member sizes, cumulative extracted size, and member count before tar extraction. Organizations unable to upgrade immediately should restrict recipe bundle pulls to trusted, curated sources and implement filesystem quota enforcement at the operating system level to limit maximum disk allocation per PraisonAI process. Additionally, monitor disk usage during recipe pulls and configure alerts to detect anomalous extraction patterns. Full remediation guidance is available in the GitHub security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f2h6-7xfr-xm8w.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Same technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today