Executive brief
PraisonAI, a framework for building multi-agent AI systems, is vulnerable to a security flaw when unpacking 'recipe' files. An attacker can create a malicious recipe file that, when opened by a user, writes or overwrites sensitive files anywhere on the user's computer. This could lead to full system compromise, data theft, or persistent unauthorized access by overwriting critical configuration files like SSH keys or shell profiles.
Technical details
A path traversal vulnerability exists in the `cmd_unpack` function within `src/praisonai/praisonai/cli/features/recipe.py`. The implementation uses `tar.extract()` on archive members without validating their paths, allowing members with `../` sequences to escape the intended destination directory. While a safe extraction utility (`_safe_extractall`) exists in the codebase, it was not utilized for the `unpack` command. An attacker can exploit this by distributing a malicious `.praison` tarball that overwrites sensitive files such as `.bashrc` or `authorized_keys`. The issue is fixed in version 4.5.128 by adopting the safe extraction method.
Affected products
- MervinPraison PraisonAI >= 2.7.2, < 4.5.128
Timeline
- 2026-04-09: disclosed: Vulnerability published by MervinPraison
- 2026-04-10: advisory: GitHub Advisory GHSA-99g3-w8gr-x37c published
- 2026-04-10: patched: Fixed in version 4.5.128