CVE-2026-40148

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the _safe_extractall() function in PraisonAI's recipe registry validates archive members against path traversal attacks but performs no checks on individual member sizes, cumulative extracted size, or member count before calling tar.extractall(). An attacker can publish a malicious recipe bundle containing highly compressible data (e.g., 10GB of zeros compressing to ~10MB) that exhausts the victim's disk when pulled via LocalRegistry.pull() or HttpRegistry.pull(). This vulnerability is fixed in 4.5.128.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f2h6-7xfr-xm8w	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) PraisonAI es un sistema de equipos multiagente. Antes de la versión 4.5.128, la función _safe_extractall() en el registro de recetas de PraisonAI valida los miembros del archivo contra ataques de salto de ruta, pero no realiza comprobaciones sobre los tamaños de los miembros individuales, el tamaño extraído acumulativo o el recuento de miembros antes de llamar a tar.extractall(). Un atacante puede publicar un paquete de recetas malicioso que contiene datos altamente compresibles (por ejemplo, 10 GB de ceros que se comprimen a ~10 MB) que agota el disco de la víctima cuando se extrae a través de LocalRegistry.pull() o HttpRegistry.pull(). Esta vulnerabilidad está corregida en la versión 4.5.128.

Information

Published : 2026-04-09 22:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40148

Mitre link : CVE-2026-40148

CVE.ORG link : CVE-2026-40148

JSON object : View

Products Affected

praison

praisonai

CWE

CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)

{"id": "CVE-2026-40148", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40148", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T20:39:35.278170Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MervinPraison", "product": "PraisonAI", "versions": [{"status": "affected", "version": "< 4.5.128"}]}]}], "published": "2026-04-09T22:16:35.600", "references": [{"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f2h6-7xfr-xm8w", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-409"}]}], "descriptions": [{"lang": "en", "value": "PraisonAI is a multi-agent teams system. Prior to 4.5.128, the _safe_extractall() function in PraisonAI's recipe registry validates archive members against path traversal attacks but performs no checks on individual member sizes, cumulative extracted size, or member count before calling tar.extractall(). An attacker can publish a malicious recipe bundle containing highly compressible data (e.g., 10GB of zeros compressing to ~10MB) that exhausts the victim's disk when pulled via LocalRegistry.pull() or HttpRegistry.pull(). This vulnerability is fixed in 4.5.128."}, {"lang": "es", "value": "PraisonAI es un sistema de equipos multiagente. Antes de la versi\u00f3n 4.5.128, la funci\u00f3n _safe_extractall() en el registro de recetas de PraisonAI valida los miembros del archivo contra ataques de salto de ruta, pero no realiza comprobaciones sobre los tama\u00f1os de los miembros individuales, el tama\u00f1o extra\u00eddo acumulativo o el recuento de miembros antes de llamar a tar.extractall(). Un atacante puede publicar un paquete de recetas malicioso que contiene datos altamente compresibles (por ejemplo, 10 GB de ceros que se comprimen a ~10 MB) que agota el disco de la v\u00edctima cuando se extrae a trav\u00e9s de LocalRegistry.pull() o HttpRegistry.pull(). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.5.128."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56CDE5F5-B03C-4C3A-9A92-F61C9DFDA9B1", "versionEndExcluding": "4.5.128"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}