Path traversal in PraisonAI recipe unpack enables file overwrite

TL;DR — A crafted .praison archive can write files outside the target directory when unpacked, enabling arbitrary file overwrite on developer machines or build hosts that run praisonai recipe unpack.

What happened

PraisonAI is a Python-based “multi-agent teams” system that includes a CLI for working with recipe bundles (.praison). A GitHub Security Advisory reports a Critical path traversal issue in the cmd_unpack flow: the CLI extracts tar members using tar.extract() without validating member paths, so entries like ../../.bashrc can be written outside the intended output directory.

The advisory includes a proof-of-concept bundle that writes ../../.bashrc during extraction, and notes that other CLI paths (e.g., pull and publish) already use a safer extraction helper.

Archive-extraction path traversal (“Zip Slip” / tar traversal) remains a high-leverage supply-chain pattern: it turns “open a bundle” workflows into filesystem write primitives, which frequently become credential theft or code execution via config/script overwrite.

Who is impacted

• Any environment running praisonai versions >= 2.7.2 and using praisonai recipe unpack.
• Developers or CI/build hosts that unpack .praison bundles from untrusted or weakly-trusted sources (shared recipe repositories, tutorial downloads, direct file sharing).
• Higher-risk setups where the unpack destination is close (in path terms) to sensitive files (shell startup files like ~/.bashrc / ~/.zshrc, SSH authorized_keys, cron configs, or adjacent project/workspace directories).

What to do now

• Follow vendor remediation guidance and apply the patched release (praisonai >= 4.5.128) referenced in the advisory.
• Treat .praison bundles as untrusted input:
  • Avoid running praisonai recipe unpack on bundles you did not build yourself or cannot validate.
  • Prefer isolated/unprivileged environments (throwaway containers / dedicated sandbox directories) for unpacking and inspection.
• If you maintain an internal fork or downstream packaging, implement the advisory’s remediation for safe extraction:

  "Replace the raw extraction loop with _safe_extractall"

• If you suspect exposure, review for unexpected file modifications outside the intended output directory around the time bundles were unpacked (e.g., shell init files, SSH keys, cron entries, and parent-directory project files).