CVE-2026-39306: 
Python vulnerability analysis and mitigation

CVE-2026-39306 is a path traversal / arbitrary file write vulnerability in PraisonAI's recipe registry pull workflow. The flaw allows a malicious publisher to craft a .praison tar archive containing ../ traversal entries; any user who subsequently pulls that recipe will have files written outside their selected output directory. It affects PraisonAI versions up to and including 4.5.112 (pip package), with version 4.5.113 containing the fix. The vulnerability was published on April 5–6, 2026, and carries a CVSS v3.1 base score of 7.3 (High) (Github Advisory, PraisonAI Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Both LocalRegistry.pull() and HttpRegistry.pull() in src/praisonai/praisonai/recipe/registry.py call Python's tarfile.extractall() without validating archive member paths, allowing ../ sequences to escape the intended recipe_dir. The publish-side code (LocalRegistry.publish()) only reads manifest.json and computes a checksum, never inspecting or sanitizing other tar members, so a malicious bundle passes checksum verification intact. An attacker with registry publish access (low privileges) crafts a .praison bundle with a benign manifest.json but includes tar entries such as ../../escape-http.txt; when a victim pulls the recipe, those entries are extracted relative to the victim's filesystem (Github Advisory, PraisonAI Advisory).

Successful exploitation allows an attacker to write arbitrary files to any location accessible by the victim's process, with high integrity and availability impact but no direct confidentiality impact. Overwriting configuration files, startup scripts, or application code can lead to code execution under the victim's account, denial of service, or persistent backdoors. CI/CD pipelines and automated systems that pull recipes are particularly at risk, as file overwrites near sensitive project directories could propagate compromise across a build environment (Github Advisory, PraisonAI Advisory).

A public proof-of-concept Python script (poc2.py) is available in the GitHub Security Advisory, demonstrating the full attack chain from publishing a malicious bundle to confirming file creation outside the intended directory (PraisonAI Advisory). The vulnerability requires low privileges (registry publish access) and user interaction (a victim must pull the recipe), but attack complexity is low. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.042–0.052%, placing it in the 17th percentile for near-term exploitation likelihood (Github Advisory).

1. Gain registry publish access: Obtain low-privilege credentials or an account on a shared or internal PraisonAI recipe registry.
2. Craft a malicious .praison bundle: Create a tar.gz archive with a benign manifest.json (to pass publish validation) and additional tar members using path traversal sequences, e.g., ../../escape-http.txt, containing a malicious payload (e.g., a modified startup script or web shell).
3. Publish the malicious recipe: Upload the crafted .praison bundle to the registry using the PraisonAI publish API. The server only validates manifest.json and computes a checksum of the full bundle — the traversal entries are stored as-is.
4. Wait for victim to pull: A victim user (or automated CI job) pulls the recipe, e.g., praisonai recipe pull evil-http --output /tmp/victim-output. The client calls tarfile.extractall() without path validation.
5. Arbitrary file write achieved: The traversal entries resolve outside /tmp/victim-output, writing attacker-controlled content to the target path (e.g., /tmp/escape-http.txt or a sensitive config/script location).
6. Escalate to code execution (optional): If the written file is a startup script, cron job, Python module, or CI configuration file, the attacker achieves code execution when that file is next invoked (Github Advisory, PraisonAI Advisory).

• File System: Unexpected files created outside the PraisonAI recipe output directory, particularly in parent directories (e.g., files appearing one or more levels above the intended pull destination); newly created or modified configuration files, startup scripts, or Python modules with recent timestamps coinciding with a recipe pull operation.
• Logs: PraisonAI registry server logs showing a publish event for an unfamiliar recipe name followed shortly by a pull from a different user or automated process; filesystem audit logs (e.g., auditd) recording file creation events in unexpected directories by the PraisonAI process.
• Process: The PraisonAI Python process writing files to paths outside its expected working or output directory, observable via tools like strace, inotifywait, or endpoint detection agents monitoring file system activity.
• Network: Outbound connections from a system that recently pulled a PraisonAI recipe to unexpected external hosts, which may indicate post-exploitation activity if a malicious script was written and executed (Github Advisory).

Upgrade PraisonAI to version 4.5.113 or later, which is the patched release addressing this vulnerability (Github Advisory, PraisonAI Advisory). As a workaround prior to patching, avoid pulling recipes from untrusted or shared registries, and restrict registry publish access to trusted users only. Operators running internal registries should implement server-side validation of tar member paths during publish to reject bundles containing ../ sequences or absolute paths before they are stored and served to downstream users.

The vulnerability was discovered and reported by security researcher R1ZZG0D, who provided a detailed write-up and working PoC as part of the responsible disclosure process (PraisonAI Advisory). The advisory was published by the maintainer (MervinPraison) on April 5, 2026, and reviewed and added to the GitHub Advisory Database on April 6, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time.