CVE-2026-44340
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
Impact
PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(dest_dir) without filter="data". A bundle that contains a symlink with a name inside dest_dir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes dest_dir and lets the attacker write arbitrary content to an attacker-chosen location on the victim's filesystem. This issue has been patched in version 4.6.37.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | PraisonAI | <= 4.6.36 | 4.6.37 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Praison | Praisonai | before 4.6.37 |