External risk intelligence

PraisonAI Recipe Unpack Arbitrary File Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-40157

This vulnerability exists in a CLI-based tool used for unpacking archive files. It requires a user to manually download and execute a malicious bundle locally. It is not an internet-facing service, API, or web application, and it does not have an exposed network surface in typical deployments.

Path Traversal

Praisonai

before 4.5.128

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This issue affects PraisonAI's recipe command-line tool, allowing a specially crafted archive to overwrite arbitrary files on a user's system. The risk is primarily associated with users downloading and unpacking malicious bundles.

Malicious archives can overwrite system files.
Leadership should remember this for supply chain risks.
Confirm relevance and user exposure for this tool.

Attack Path

How an attacker could exploit the issue

An attacker can trick a user into unpacking a malicious archive file using the `praisonai recipe unpack` command. This archive is crafted to contain directory traversal sequences, allowing it to write files anywhere on the user's system, potentially overwriting critical data or executable files when the command is run.

Requires user to unpack malicious archive.
Malicious archive triggers file overwrites.
Risk of arbitrary file overwrite.

Live Threat

Current exploitation, exposure, and threat context

When a user unpacks a malicious `.praison` archive using the `praisonai recipe unpack` command, arbitrary files on the victim's filesystem could be overwritten. This occurs because the tool extracts tar archives without adequately validating archive member paths, allowing for directory traversal.

System files could be overwritten.
Malicious bundles could be unpacked.
System stability could be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects the `praisonai recipe unpack` command, potentially allowing attackers to overwrite arbitrary files. Ownership likely falls to teams managing the PraisonAI application or the development teams responsible for its use, with infrastructure and security teams involved in broader exposure assessment and remediation planning. The first practical step involves identifying all instances of the `praisonai` CLI, determining if they handle untrusted archives, confirming business criticality, and then prioritizing remediation efforts.

Application or development teams own the issue.
Verify untrusted archive handling and exposure.
Plan and coordinate remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework designed to simplify the creation and management of multi-agent teams. Developers and data engineers use this system to automate workflows by orchestrating multiple AI agents to work together on specific tasks. The software includes command-line tools, such as the recipe CLI, to package and unpack AI agent configurations into .praison bundles.

What is the vulnerability in CVE-2026-40157?

This issue is classified as Improper Limitation of a Pathname to a Restricted Directory, or CWE-22. It occurs because the tool fails to check if files inside a .praison archive are attempting to escape the intended folder. When unpacking a malicious bundle, the software treats these unauthorized paths as valid, allowing the archive to write or overwrite files anywhere on the user's computer.

How is this vulnerability triggered?

The flaw is triggered only when a user manually executes the praisonai recipe unpack command on a specially crafted, malicious .praison archive. If you are not actively unpacking untrusted or third-party bundles using this command, the vulnerability remains dormant. Simply having the PraisonAI software installed does not trigger the bug.

How relevant is CVE-2026-40157 to my systems?

According to Halo Surface Signal, this vulnerability is very unlikely to be exploited remotely. Because it exists in a CLI-based tool that requires a user to manually download and unpack a file, it does not function as an internet-facing service or web application. The risk is localized to systems where users actively import external or untrusted agent recipes.

What should I do to secure my environment?

The primary response is to update your PraisonAI installation to version 4.5.128 or newer, which includes the necessary path validation logic. You should also audit your workflows to ensure that only trusted .praison archives are being processed. If you manage multiple environments, prioritize updating systems where users frequently handle agent recipes from external sources.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-99g3…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.