CVE-2026-40148— PraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI是Mervin Praison个人开发者的一个低代码多智能体协作框架。 PraisonAI 4.5.128之前版本存在安全漏洞，该漏洞源于_safe_extractall函数未检查归档成员大小、累计大小或数量，可能导致攻击者通过恶意压缩包耗尽受害者磁盘空间。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-40148
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the _safe_extractall() function in PraisonAI's recipe registry validates archive members against path traversal attacks but performs no checks on individual member sizes, cumulative extracted size, or member count before calling tar.extractall(). An attacker can publish a malicious recipe bundle containing highly compressible data (e.g., 10GB of zeros compressing to ~10MB) that exhausts the victim's disk when pulled via LocalRegistry.pull() or HttpRegistry.pull(). This vulnerability is fixed in 4.5.128.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Vulnerability Title
PraisonAI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PraisonAI是Mervin Praison个人开发者的一个低代码多智能体协作框架。 PraisonAI 4.5.128之前版本存在安全漏洞，该漏洞源于_safe_extractall函数未检查归档成员大小、累计大小或数量，可能导致攻击者通过恶意压缩包耗尽受害者磁盘空间。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | < 4.5.128 | - |
|
II. Public POCs for CVE-2026-40148
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40148
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-40148 (1)
Same Patch Batch · MervinPraison · 2026-04-09 · 15 CVEs total
| CVE-2026-40088 | 9.7 CRITICAL | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| CVE-2026-40154 | 9.3 CRITICAL | PraisonAI Affected by Untrusted Remote Template Code Execution |
| CVE-2026-40113 | 8.4 HIGH | PraisonAI has an Argument Injection into Cloud Run Environment Variables via Unsanitized C |
| CVE-2026-40149 | 7.9 HIGH | PraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safe |
| CVE-2026-40150 | 7.7 HIGH | PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool |
| CVE-2026-40116 | 7.5 HIGH | PraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without |
| CVE-2026-40153 | 7.4 HIGH | PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvar |
| CVE-2026-40114 | 7.2 HIGH | PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API |
| CVE-2026-40115 | 6.2 MEDIUM | PraisonAI has an Unrestricted Upload Size in WSGI Recipe Registry Server Enables Memory Ex |
| CVE-2026-40117 | 6.2 MEDIUM | PraisonAIAgents Affected by Arbitrary File Read via read_skill_file Missing Workspace Boun |
| CVE-2026-40112 | 5.4 MEDIUM | PraisonAI has Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Require |
| CVE-2026-40151 | 5.3 MEDIUM | PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /ap |
| CVE-2026-40152 | 5.3 MEDIUM | PraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list_files Bypasses W |
| CVE-2026-40111 | PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memor |
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-55536
Browser Server WebSocket origin validation bypass via unanch -
CVE-2026-55532
PraisonAI: Origin-validation bypass (startswith prefix match -
CVE-2026-55533
PraisonAI: Authentication fail-open in Recipe server allows -
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/ -
CVE-2026-55527
PraisonAI: Arbitrary file write via unsanitized `user_id` in
Same vendor: MervinPraison
-
CVE-2026-55536
Browser Server WebSocket origin validation bypass via unanch -
CVE-2026-55532
PraisonAI: Origin-validation bypass (startswith prefix match -
CVE-2026-55533
PraisonAI: Authentication fail-open in Recipe server allows -
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/ -
CVE-2026-55527
PraisonAI: Arbitrary file write via unsanitized `user_id` in
Same weakness: CWE-409
-
CVE-2026-80189
LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consump -
CVE-2026-78206
exceljs through 4.4.0 Uncontrolled Resource Consumption via -
CVE-2026-53524
WeeChat has a Decompression Bomb in Relay WebSocket (DoS) -
CVE-2026-11617
Tanium addressed a compression bomb vulnerability in Finding -
CVE-2026-75476
Tanium addressed a compression bomb vulnerability in Threat
V. Comments for CVE-2026-40148
No comments yet