PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .praison tar archives using raw tar.extract() without validating archive member paths. A .praison bundle containing ../../ entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim's filesystem when they run praisonai recipe unpack. This vulnerability is fixed in 4.5.128.
The cmd_unpack function in the CLI interface (praisonai recipe unpack command) extracts .praison archives using tar.extract() without validating the paths contained in the archive. An attacker can prepare a malicious .praison package containing entries with paths like ../../, which during extraction point to directories outside the target output directory. When the victim runs the unpack command on such a package, files are written outside the intended directory — potentially anywhere on the file system.
An attacker can overwrite arbitrary files on the victim's file system, which may lead to system takeover, integrity compromise, or service disruption (e.g., by overwriting configuration files, system binaries, or startup scripts).
Update PraisonAI to version 4.5.128 or later, in which the vulnerability has been removed. Until the update is applied, avoid unpacking .praison packages from untrusted sources.
PraisonAI (Praisonai) in versions before 4.5.128.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XPraison Praisonai
APPPraison< 4.5.128
Related vulnerabilities
Path Traversal i RCE w PraisonAI MCP Server (serwer narzędzi plikowych)
Command Injection w PraisonAI — brak walidacji poleceń MCP
PraisonAI – nieuwierzytelnione przejęcie sesji przeglądarki przez WebSocket
PraisonAI – wyciek tokenów GitHub przez atak ArtiPACKED w CI/CD
PraisonAI — RCE i command injection przez niezaufowane pliki YAML