CVE-2026-40157: 
Python vulnerability analysis and mitigation

CVE-2026-40157 is a path traversal vulnerability ("Zip Slip" / tar path traversal) in PraisonAI's recipe CLI that enables arbitrary file writes on a victim's filesystem. The cmd_unpack function in cli/features/recipe.py extracts .praison tar archives using Python's raw tar.extract() without validating archive member paths, allowing ../../ sequences to escape the intended output directory. Affected versions are >= 2.7.2 and < 4.5.128 of the praisonai pip package; the vulnerability is fixed in version 4.5.128. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory, PraisonAI Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The vulnerable code in src/praisonai/praisonai/cli/features/recipe.py lines 1170–1172 iterates over tar members and calls tar.extract(member, recipe_dir) with only a check for manifest.json membership — it never validates for absolute paths, .. components, or symlinks. Python's tarfile.extract() resolves member names relative to the destination directory, so a member named ../../.bashrc writes two directories above recipe_dir. Notably, the codebase already contains a safe extraction function _safe_extractall in recipe/registry.py (used by recipe pull and recipe publish) that rejects absolute paths, .. segments, and resolved paths outside the destination — but cmd_unpack does not call it (GitHub Advisory, PraisonAI Advisory).

Successful exploitation allows an attacker to overwrite arbitrary files on the victim's filesystem with attacker-controlled content, limited only by the filesystem permissions of the user running praisonai. High-value targets include shell configuration files (.bashrc, .zshrc), SSH authorized_keys, cron entries, and project source files in parent directories, any of which can be leveraged to achieve persistent code execution. The attacker controls both the path and the content of every written file, making this an effective arbitrary file write-to-code-execution primitive (GitHub Advisory).

A complete, runnable Python proof-of-concept that constructs a malicious .praison tar archive with path traversal payloads is publicly available in the GitHub security advisory (PraisonAI Advisory). Exploitation requires user interaction — the victim must run praisonai recipe unpack on a malicious bundle — but no privileges or authentication are required on the attacker's side. The EPSS score is approximately 0.072–0.084%, and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time (GitHub Advisory).

1. Craft a malicious .praison bundle: Use the public PoC Python script to create a tar archive containing a legitimate manifest.json and one or more entries with path traversal sequences (e.g., ../../.bashrc) pointing to sensitive files outside the intended extraction directory.

import tarfile, io, json
manifest = json.dumps({"name": "legit-recipe", "version": "1.0.0"}).encode()
with tarfile.open("malicious.praison", "w:gz") as tar:
    info = tarfile.TarInfo(name="manifest.json")
    info.size = len(manifest)
    tar.addfile(info, io.BytesIO(manifest))
    payload = b"export EVIL=1 # injected by malicious recipe\n"
    evil = tarfile.TarInfo(name="../../.bashrc")
    evil.size = len(payload)
    tar.addfile(evil, io.BytesIO(payload))

2. Distribute the malicious bundle: Share the .praison file via a shared recipe repository, tutorial link, direct message, or any social engineering channel targeting PraisonAI users.
3. Victim triggers extraction: The victim runs praisonai recipe unpack malicious.praison -o ./recipes, which invokes the vulnerable cmd_unpack function.
4. Path traversal executes: The tar.extract() call resolves ../../.bashrc relative to recipe_dir, writing the attacker-controlled payload to the user's home directory (or another targeted location).
5. Achieve code execution: On the victim's next shell login (or cron execution, SSH connection, etc.), the injected payload executes in the context of the victim's user account, enabling persistence, credential theft, or further lateral movement (PraisonAI Advisory).

• File System: Unexpected modifications to ~/.bashrc, ~/.zshrc, ~/.ssh/authorized_keys, or crontab files with timestamps coinciding with a praisonai recipe unpack invocation; new or modified files in parent directories of the intended recipe output directory.
• Logs: Shell history entries containing praisonai recipe unpack with an external or unfamiliar .praison file path; file access logs showing writes to paths outside the expected recipe extraction directory.
• Process: Unexpected processes spawned from shell initialization scripts (e.g., reverse shells, curl/wget downloads) shortly after user login, potentially traceable to injected .bashrc or .zshrc content.
• Network: Outbound connections to unknown external hosts initiated by shell startup scripts or cron jobs, particularly if the injected payload includes a callback mechanism (PraisonAI Advisory).

Upgrade PraisonAI to version 4.5.128 or later, which fixes the vulnerability by replacing the raw extraction loop in cmd_unpack with the existing _safe_extractall function from recipe/registry.py (GitHub Advisory, PraisonAI Advisory). Until patching is possible, only unpack .praison bundles from fully trusted sources, and manually inspect archive contents with tar -tzf <file>.praison before extraction to check for .. path components. Additionally, consider running praisonai under a restricted user account or in a sandboxed environment (e.g., a container) to limit the blast radius of any successful exploitation.

The vulnerability was reported by researcher Mundi-Xu and published by the maintainer on April 9, 2026, with a patch released the same day. The advisory was detected by Qualys (detection ID 5010813) and indexed by ENISA's EUVD (EUVD-2026-21509). No significant broader media coverage or notable community debate has been identified beyond standard CVE tracking and aggregator indexing (GitHub Advisory).