CVE-2026-40157 MervinPraison CVE debrief

Who should care

Administrators and users of PraisonAI should assess their exposure and upgrade to version 4.5.128 or later to prevent arbitrary file overwrite. They should also validate archive member paths when extracting .praison tar archives and monitor for suspicious activity related to praisonai recipe unpack. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, and to

Why it matters

CVE-2026-40157 is a critical vulnerability in PraisonAI that allows an attacker to overwrite arbitrary files on the victim's filesystem. Administrators and users should assess their exposure and upgrade to version 4.5.128 or later to prevent this vulnerability.

• Overwriting arbitrary files on the victim's filesystem
• Potential for data loss or corruption
• Need for validation of archive member paths

Technical summary

The cmd_unpack function in the recipe CLI of PraisonAI extracts .praison tar archives using raw tar.extract() without validating archive member paths. This allows an attacker to overwrite arbitrary files on the victim's filesystem when they run praisonai recipe unpack. A .praison bundle containing ../../ entries can write files outside the intended output directory. The vulnerability is fixed in version 4.5.128. To prevent this vulnerability, administrators and users should assess their exposure and upgrade to version 4.5.128 or later.

Defensive priority

High

Recommended defensive actions

• Upgrade to version 4.5.128 or later
• Validate archive member paths when extracting .praison tar archives
• Monitor for suspicious activity related to praisonai recipe unpack
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the cmd_unpack function in the recipe CLI extracting .praison tar archives using raw tar.extract() without validating archive member paths. A .praison bundle containing ../../ entries can write files outside the intended output directory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.