CVE-2026-40157: PraisonAI Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-99g3-w8gr-x37c",
  "modified" : "2026-04-10T19:27:59Z",
  "published" : "2026-04-10T19:27:59Z",
  "aliases" : [ "CVE-2026-40157" ],
  "summary" : "PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`",
  "details" : "| Field | Value |\n|---|---|\n| Severity | Critical |\n| Type | Path traversal -- arbitrary file write via `tar.extract()` without member validation |\n| Affected | `src/praisonai/praisonai/cli/features/recipe.py:1170-1172` |\n\n## Summary\n\n`cmd_unpack` in the recipe CLI extracts `.praison` tar archives using raw `tar.extract()` without validating archive member paths. A `.praison` bundle containing `../../` entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim's filesystem when they run `praisonai recipe unpack`.\n\n## Details\n\nThe vulnerable code is in `cli/features/recipe.py:1170-1172`:\n\n```python\nfor member in tar.getmembers():\n    if member.name != \"manifest.json\":\n        tar.extract(member, recipe_dir)\n```\n\nThe only check is whether the member is `manifest.json`. The code never validates member names -- absolute paths, `..` components, and symlinks all pass through. Python's `tarfile.extract()` resolves these relative to the destination, so a member named `../../.bashrc` lands two directories above `recipe_dir`.\n\nThe codebase does contain a safe extraction function (`_safe_extractall` in `recipe/registry.py:131-162`) that rejects absolute paths, `..` segments, and resolved paths outside the destination. It is used by the `pull` and `publish` paths, but `cmd_unpack` does not call it.\n\n```python\n# recipe/registry.py:141-159 -- safe version exists but is not used by cmd_unpack\ndef _safe_extractall(tar: tarfile.TarFile, dest_dir: Path) -> None:\n    dest = str(dest_dir.resolve())\n    for member in tar.getmembers():\n        if os.path.isabs(member.name):\n            raise RegistryError(...)\n        if \"..\" in member.name.split(\"/\"):\n            raise RegistryError(...)\n        resolved = os.path.realpath(os.path.join(dest, member.name))\n        if not resolved.startswith(dest + os.sep):\n            raise RegistryError(...)\n    tar.extractall(dest_dir)\n```\n\n## PoC\n\nBuild a malicious bundle:\n\n```python\nimport tarfile, io, json\n\nmanifest = json.dumps({\"name\": \"legit-recipe\", \"version\": \"1.0.0\"}).encode()\n\nwith tarfile.open(\"malicious.praison\", \"w:gz\") as tar:\n    info = tarfile.TarInfo(name=\"manifest.json\")\n    info.size = len(manifest)\n    tar.addfile(info, io.BytesIO(manifest))\n\n    payload = b\"export EVIL=1  # injected by malicious recipe\\n\"\n    evil = tarfile.TarInfo(name=\"../../.bashrc\")\n    evil.size = len(payload)\n    tar.addfile(evil, io.BytesIO(payload))\n```\n\nTrigger:\n\n```bash\npraisonai recipe unpack malicious.praison -o ./recipes\n# Expected: files written only under ./recipes/legit-recipe/\n# Actual:   .bashrc written two directories above the output dir\n```\n\n## Impact\n\n| Path | Traversal blocked? |\n|------|--------------------|\n| `praisonai recipe pull <name>` | Yes -- uses `_safe_extractall` |\n| `praisonai recipe publish <bundle>` | Yes -- uses `_safe_extractall` |\n| `praisonai recipe unpack <bundle>` | No -- raw `tar.extract()` |\n\nAn attacker needs to get a victim to unpack a malicious `.praison` bundle -- say, through a shared recipe repository, a link in a tutorial, or by sending it to a colleague directly.\n\nDepending on filesystem permissions, an attacker can overwrite shell config files (`.bashrc`, `.zshrc`), cron entries, SSH `authorized_keys`, or project files in parent directories. The attacker controls both the path and the content of every written file.\n\n## Remediation\n\nReplace the raw extraction loop with `_safe_extractall`:\n\n```python\n# cli/features/recipe.py:1170-1172\n# Before:\nfor member in tar.getmembers():\n    if member.name != \"manifest.json\":\n        tar.extract(member, recipe_dir)\n\n# After:\nfrom praisonai.recipe.registry import _safe_extractall\n_safe_extractall(tar, recipe_dir)\n```\n\n### Affected paths\n\n- `src/praisonai/praisonai/cli/features/recipe.py:1170-1172` -- `cmd_unpack` extracts tar members without path validation",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "PraisonAI"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.7.2"
      }, {
        "fixed" : "4.5.128"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-99g3-w8gr-x37c"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40157"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.128"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-10T19:27:59Z",
    "nvd_published_at" : "2026-04-10T17:17:13Z"
  }
}