Is CVE-2026-40157 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40157 being exploited in the wild.

How severe is CVE-2026-40157?

Critical severity, with a CVSS score of 8.8, published 10 April 2026.

Which products and versions are affected?

praisonai (PyPI) ECOSYSTEM:introduced=2.7.2,fixed=4.5.128.

Is there a fix for CVE-2026-40157?

Yes. praisonai (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40157 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40157?

Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40157: MervinPraison PraisonAI path traversal in recipe CLI

CVE-2026-40157 · Severity: critical · CVSS 8.8 · Published 2026-04-10

PraisonAI, a framework for building multi-agent AI systems, is vulnerable to a security flaw when unpacking 'recipe' files. An attacker can create a malicious recipe file that, when opened by a user, writes or overwrites sensitive files anywhere on the user's computer. This could lead to full system compromise, data theft, or persistent unauthorized access by overwriting critical configuration files like SSH keys or shell profiles.

Technologies: Praisonai, praisonai (PyPI). Vendors: Praison, PyPI.

Quick answers

Is CVE-2026-40157 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40157 being exploited in the wild.
How severe is CVE-2026-40157?: Critical severity, with a CVSS score of 8.8, published 10 April 2026.
Which products and versions are affected?: praisonai (PyPI) ECOSYSTEM:introduced=2.7.2,fixed=4.5.128.
Is there a fix for CVE-2026-40157?: Yes. praisonai (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40157 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40157?: Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonai (PyPI): upgrade to 4.5.128 or later
```
pip install "praisonai>=4.5.128"
```

Technical details

A path traversal vulnerability exists in the `cmd_unpack` function within `src/praisonai/praisonai/cli/features/recipe.py`. The implementation uses `tar.extract()` on archive members without validating their paths, allowing members with `../` sequences to escape the intended destination directory. While a safe extraction utility (`_safe_extractall`) exists in the codebase, it was not utilized for the `unpack` command. An attacker can exploit this by distributing a malicious `.praison` tarball that overwrites sensitive files such as `.bashrc` or `authorized_keys`. The issue is fixed in version 4.5.128 by adopting the safe extraction method.

Affected products

MervinPraison PraisonAI >= 2.7.2, < 4.5.128

Identifiers

CVE-2026-40157
GHSA-99g3-w8gr-x37c
PYSEC-2026-469

Timeline

2026-04-09: disclosed: Vulnerability published by MervinPraison
2026-04-10: advisory: GitHub Advisory GHSA-99g3-w8gr-x37c published
2026-04-10: patched: Fixed in version 4.5.128

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.