{
  "ticket_id": "CVE-2026-44340",
  "code_root": "external/praisonai",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-44340",
    "advisory_id": "GHSA-9q28-ghcr-c4x3",
    "advisory_url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9q28-ghcr-c4x3",
    "vendor": "MervinPraison",
    "product": "PraisonAI",
    "repo": "https://github.com/MervinPraison/PraisonAI"
  },
  "facts": {
    "cve_id": "CVE-2026-44340",
    "advisory_id": "GHSA-9q28-ghcr-c4x3",
    "issue_summary": "ZipSlip / path traversal in PraisonAI. The _safe_extractall helper (used by all recipe pull/publish/unpack flows) validates each tar member's NAME for absolute paths, '..', and resolved-path escape, but never validates member.linkname. A symlink member whose link target points outside dest_dir is extracted unchecked; a subsequent write entry that traverses through that symlink then lands outside the destination directory.",
    "vulnerability_type": "Path Traversal (archive extraction / ZipSlip)",
    "suspected_cwe": ["CWE-22"],
    "affected_versions": "< 4.6.37",
    "fixed_versions": ["4.6.37"],
    "reproduce_version": "4.6.36",
    "verify_fixed_version": "4.6.37",
    "repo_url": "https://github.com/MervinPraison/PraisonAI.git",
    "code_root": "external/praisonai",
    "ecosystem": "pypi",
    "package": "praisonai",
    "affected_functions": ["_safe_extractall"],
    "install_recipe": "In a fresh virtualenv run `pip install praisonai==4.6.36` (vulnerable) or `pip install praisonai==4.6.37` (fixed). The published PyPI wheel is the canonical artifact; git tags v4.6.36 / v4.6.37 on the repo are equivalent.",
    "attacker_access": "Any code path that pulls, publishes, or unpacks a recipe archive supplied by an attacker (the recipe tar is the untrusted input).",
    "exploit_outline": "Craft a tar archive with two members: (1) a symlink member whose linkname points outside dest_dir, and (2) a regular file member written through that symlink. Feed the archive to the recipe-unpack code path that calls _safe_extractall.",
    "vulnerable_indicator": "After extraction, a file has been written outside dest_dir (the location the symlink target pointed to).",
    "fixed_indicator": "In 4.6.37 _safe_extractall rejects the malicious symlink member (linkname is now validated); no file is written outside dest_dir.",
    "reproduction_requirements": "Python (any maintained version) plus the praisonai package at the specified version. No network service, database, or browser required - the difference is observable purely on the local filesystem by checking whether a file appears outside dest_dir after extraction.",
    "notes": "Do not invent specific version numbers or commit hashes beyond those stated here. The Pruva repro agent reads the patch diff itself (git diff v4.6.36..v4.6.37) to confirm the root cause and the linkname guard."
  }
}