EUVD-2026-21509
GHSA-99g3-w8gr-x37c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDistribute malicious .praison tar archive
-
DeliveryVictim runs praisonai recipe unpack command
-
ExploitExtract without path validation
-
ExecutionTraversal writes files outside directory
-
ImpactArbitrary file overwrite on filesystem
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker distributes a malicious .praison tar archive with path traversal entries (../../). Victim must execute |
| Impact | CVSS 9.4 reflects unauthenticated network-accessible path traversal enabling arbitrary file overwrite. EPSS data unavailable; however, attack requires user interaction (UI:P) to unpack a malicious .praison bundle, limiting immediate blast radius. Fixed in 4.5.128. Organizations running older versions face severe risk if bundles from untrusted sources are processed. |
| Exploit ScenarioDerived | Attacker crafts malicious .praison tar archive with path traversal entries (e.g., ../../etc/passwd). Victim downloads bundle and runs |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Path traversal in PraisonAI multi-agent teams system (versions prior to 4.5.128) enables arbitrary file overwrite through malicious .praison archive bundles. The cmd_unpack function in recipe CLI performs unvalidated tar extraction, allowing attackers to embed ../ path sequences that escape the intended extraction directory. Unauthenticated attackers can distribute weaponized bundles that, when unpacked by victims via 'praisonai recipe unpack' command, overwrite critical system files with attacker-controlled content. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade immediately to PraisonAI version 4.5.128 or later, which implements path validation in cmd_unpack extraction routine. Until patched, avoid unpacking untrusted .praison recipe bundles from unknown sources. Implement filesystem sandboxing or chroot environments for recipe extraction workflows in production deployments. Organizations should audit existing recipe archives for malicious path entries before migration to patched version. Review filesystem integrity if previously unpacked untrusted bundles. Full advisory and patch details: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-99g3-w8gr-x37c
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-22 path traversal via unsafe tar.extract() implementation. Archive member paths lack validation against directory traversal sequences (../../) during extraction. Python tarfile module used without filter or validation callbacks permits symlink and absolute path exploitation when processing untrusted .praison archives.
Know when Praisonai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .praison tar archives using raw tar.extract() without validating archive member paths. A .praison bundle containing ../../ entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim's filesystem when they run praisonai recipe unpack. This vulnerability is fixed in 4.5.128.
Executive ViewAI
PraisonAI versions below 4.5.128 contain a critical path traversal vulnerability in archive extraction that allows unauthenticated attackers to overwrite arbitrary system files when users unpack malicious .praison bundles. Organizations deploying PraisonAI for multi-agent workflows face immediate risk of system compromise if users interact with untrusted recipe bundles, with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict 'praisonai recipe unpack' command execution to trusted, air-gapped environments only; (2) Require manual bundle inspection and validation before unpacking; (3) Disable PraisonAI recipe functionality until patched version is released; (4) Implement application sandboxing to contain file write operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in PraisonAI Multiple Code Execution and Path Traversal
View all 5PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Exploit-DB