PraisonAI EUVD-2026-28643

Vulnerability triggers when PraisonAI processes tar archive bundles through recipe pull, publish, or unpack operations. Exploitation requires victim instance to ingest attacker-controlled recipe bundle, which occurs if: (1) PraisonAI exposes recipe upload/import functionality accessible to untrusted users, (2) administrators manually import recipes from untrusted sources, or (3) automated recipe synchronization pulls from attacker-controlled repositories. Default PraisonAI configuration exposes recipe management APIs, making network-accessible instances vulnerable. No user interaction required once bundle reaches extraction code path (UI:N in CVSS). Attack succeeds against default configurations without special settings. Exploitation is limited by filesystem permissions of the PraisonAI process - write operations only succeed in directories where the process has write access, but many deployments run with elevated privileges for AI model management.

CVSS 4.0 score of 8.7 reflects network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and high integrity impact (VI:H) with no confidentiality or availability impact. The vulnerability enables arbitrary file write but not read or denial-of-service, limiting immediate exploitation appeal. No CISA KEV listing and no reported active exploitation suggest this remains a latent risk rather than widely exploited threat. Attack complexity is genuinely low for skilled attackers (crafting malicious tar archives is straightforward), but exploitation requires victims to process attacker-supplied recipe bundles through PraisonAI's recipe operations. Real-world risk depends heavily on deployment context: internet-facing recipe ingestion endpoints present higher risk than isolated development environments. The network vector (AV:N) combined with no authentication (PR:N) makes this exploitable against any exposed PraisonAI instance accepting recipe bundles, but absence of observed exploitation and specialized target (AI workflow systems) suggests limited current threat landscape activity. Organizations should prioritize patching if PraisonAI instances process recipes from untrusted sources.

An attacker crafts a malicious tar bundle containing a symlink entry named recipes/link.txt with linkname pointing to /etc/cron.d/, followed by a regular file entry at recipes/link.txt/malicious-cron that writes cron job configuration. When a victim PraisonAI instance processes this bundle via recipe pull/publish/unpack, the extraction creates the symlink, then writes through it to place the attacker's cron job in /etc/cron.d/malicious-cron, achieving persistence and arbitrary command execution. No public POC exists but attack construction is straightforward using standard tar manipulation tools.