Executive brief
PraisonAI, a framework for AI agents, contains a vulnerability in how it handles compressed recipe files. An attacker can create a specially crafted archive that, when processed by the system, bypasses security checks to write files to any location on the victim's computer. This could allow an attacker to gain persistent access to a system, overwrite critical configuration files, or disrupt operations, especially if the software is running with high privileges.
Technical details
The `_safe_extractall` helper function in `recipe/registry.py` fails to validate the `linkname` attribute of symlink and hardlink members within TAR archives. While the function checks the `name` attribute for path traversal sequences, it does not inspect the link target or use the `filter="data"` argument in `tar.extractall()`. An attacker can craft a bundle containing a symlink pointing to a sensitive system directory, followed by a file that traverses through that symlink. This bypasses the existing path validation logic, enabling arbitrary file writes during `recipe pull`, `recipe publish`, or `recipe unpack` operations. The vulnerability is fixed in version 4.6.37 by implementing stricter extraction filters.
Affected products
- MervinPraison PraisonAI >= 2.7.2, <= 4.6.36
Timeline
- 2026-05-04: disclosed: Reported privately to maintainers
- 2026-05-08: advisory: NVD publication
- 2026-05-11: patched: GitHub Advisory published and fix confirmed in v4.6.37