CVE-2026-40148: 
Python vulnerability analysis and mitigation

CVE-2026-40148 is a decompression bomb (zip bomb) denial-of-service vulnerability in PraisonAI, a multi-agent AI teams system. The flaw exists in the _safe_extractall() function within the recipe registry module, which validates archive members for path traversal but imposes no limits on individual member sizes, cumulative extracted size, or member count. All versions of PraisonAI prior to 4.5.128 (specifically <= 4.5.124) are affected. The vulnerability was published on April 9, 2026, and patched in version 4.5.128. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, PraisonAI Advisory).

The root cause is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification). The vulnerable function _safe_extractall() at src/praisonai/praisonai/recipe/registry.py:131-162 correctly rejects absolute paths and path traversal sequences (..) in archive members, but never reads the TarInfo.size attribute — which represents the uncompressed size — before calling tar.extractall(). This allows an attacker to craft a .praison recipe bundle containing highly compressible data (e.g., 10GB of zero bytes compressed to ~10MB with gzip) and publish it to a local or HTTP registry. When any user calls LocalRegistry.pull() or HttpRegistry.pull(), the archive is silently extracted in full, exhausting available disk space. No authentication is required to publish to the local registry, and HTTP registry bundles are fetched from attacker-controlled servers (PraisonAI Advisory, GitHub Advisory).

Successful exploitation results in complete disk exhaustion on the victim's system, causing a denial-of-service condition that affects not only PraisonAI but potentially all other applications sharing the same filesystem. There is no confidentiality or integrity impact — the attack is purely an availability attack. Because the extraction occurs silently during a routine pull() operation with no progress indication or size warning, victims have no opportunity to interrupt the process before disk space is consumed (PraisonAI Advisory).

A complete proof-of-concept exploit (bash/Python sequence) is publicly available in the official security advisory, demonstrating how to create a malicious recipe bundle, publish it, and trigger disk exhaustion against a real PraisonAI deployment (PraisonAI Advisory). There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.034–0.054%, placing it in the 17th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Create a malicious recipe bundle: On an attacker-controlled machine, create a directory and generate a 10GB file of zeros that compresses to ~10MB: dd if=/dev/zero of=agent.yaml bs=1M count=10240. Create a valid manifest.json referencing the file, then bundle both into a .praison archive: tar czf useful-recipe-1.0.0.praison manifest.json agent.yaml.
2. Publish the malicious bundle: Publish the ~10MB compressed bundle to a local registry (no authentication required) using LocalRegistry.publish('useful-recipe-1.0.0.praison'), or host it on an attacker-controlled HTTP server accessible via HttpRegistry.
3. Social engineer the victim: Convince a PraisonAI user to pull the recipe by name (e.g., by advertising it as a useful AI agent recipe in a public forum or repository).
4. Trigger disk exhaustion: When the victim executes LocalRegistry.pull('useful-recipe') or the equivalent HTTP registry pull, _safe_extractall() decompresses the archive without size checks, writing 10GB+ to disk silently until the filesystem is full.
5. Achieve denial of service: The victim's disk is exhausted, causing PraisonAI and other co-located applications to fail due to inability to write to disk (PraisonAI Advisory, GitHub Advisory).

• File System: Sudden, rapid growth of files in the PraisonAI recipe extraction directory (typically within the local registry path); presence of unexpectedly large files (multi-gigabyte) with names matching recipe bundle contents (e.g., agent.yaml) in the extraction destination.
• Logs: Disk-full errors (OSError: [Errno 28] No space left on device) in PraisonAI logs or system logs coinciding with a pull() operation; absence of size-limit or extraction-warning log entries during extraction.
• Process: Python process running PraisonAI consuming sustained high disk I/O during a pull() call; tar or Python file write operations writing continuously to the registry extraction directory.
• System: Filesystem utilization alerts reaching 100% on the partition hosting the PraisonAI registry; other applications on the same host failing due to inability to write files (PraisonAI Advisory).

Upgrade PraisonAI to version 4.5.128 or later, which adds member count limits (MAX_MEMBER_COUNT = 1000) and cumulative extraction size limits (MAX_EXTRACT_SIZE = 500MB) to _safe_extractall(). As interim workarounds, restrict recipe bundle sources to trusted registries only, implement OS-level disk quotas or filesystem size limits on the directory used for recipe extraction, and set up disk space monitoring and alerts. Avoid pulling recipe bundles from untrusted or unknown sources (PraisonAI Advisory, GitHub Advisory).