Read the docs
TI-2026-32307 Aliases CVE-2026-44340GHSA-9q28-ghcr-c4x3

PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(dest_dir) without filter="data". A bundle that contains a symlink with a name inside dest_dir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes dest_dir and lets the attacker write arbitrary content to an attacker-chosen location on the victim's filesystem. This issue has been patched in version 4.6.37.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00433 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed PraisonAI (MervinPraison): 4.6.37PraisonAI (PyPI): 4.6.37

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MervinPraisonPraisonAIbefore 4.6.374.6.37Patch availableCNA
—PraisonAI (PyPI)before 4.6.374.6.37Patch availableGHSA-9q28-ghcr-c4x3
  • PraisonAI VendorMervinPraison Affected before 4.6.37 Fixed in 4.6.37 Patch available CNA
  • PraisonAI (PyPI) Vendor— Affected before 4.6.37 Fixed in 4.6.37 Patch available GHSA-9q28-ghcr-c4x3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*before 4.6.37VulnerableMervinPraison
  • cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions before 4.6.37 Vulnerable ·MervinPraison

Remediation

  • Fix · CNA PraisonAI (MervinPraison) Fixed in 4.6.37
  • Fix · GHSA-9q28-ghcr-c4x3 PraisonAI (PyPI) Fixed in 4.6.37 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44340
  2. 2026-10-03 Alias added: GHSA-9q28-ghcr-c4x3

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-30083 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI CVSS 3.1CRITICAL 9.8
  • TI-2026-29070 PraisonAI: Critical RCE via `type: job` workflow YAML CVSS 3.1CRITICAL 9.8
  • TI-2026-28940 PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API CVSS 3.1CRITICAL 10.0
  • TI-2026-28768 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading CVSS 3.1CRITICAL 9.8
  • TI-2026-27159 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() CVSS 3.1CRITICAL 9.8
  • TI-2026-27158 PraisonAI: Second-Order SQL Injection in `get_all_user_threads` CVSS 3.1CRITICAL 9.8
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences