CVE-2026-40148: PraisonAI decompression bomb in recipe registry extraction

Executive brief

PraisonAI, a framework for managing AI agents and recipes, is vulnerable to a 'decompression bomb' attack. An attacker can create a specially crafted recipe file that appears small but expands to a massive size when opened, potentially filling up a user's hard drive. This can cause the system to crash or stop working correctly, leading to a denial of service.

Technical details

The `_safe_extractall()` function in `src/praisonai/praisonai/recipe/registry.py` fails to validate the uncompressed size or member count of tar archives before extraction. While the function implements path traversal protections, it does not inspect the `size` attribute of `TarInfo` objects. An attacker can provide a malicious recipe bundle via `LocalRegistry.pull()` or `HttpRegistry.pull()` that contains highly compressed data (e.g., 10GB of zeros compressed to 10MB). When a user pulls this recipe, the extraction process exhausts available disk space. This vulnerability is classified as CWE-409 and is fixed in version 4.5.128.

Affected products

• MervinPraison PraisonAI < 4.5.128

Timeline

• 2026-04-09: disclosed
• 2026-04-09: patched: Fixed in version 4.5.128
• 2026-04-10: advisory

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D