The vulnerability CVE-2026-40157 in PraisonAI (prior to version 4.5.128) involves improper limitation of pathname to a restricted directory (CWE-22). The cmd_unpack function in the recipe CLI uses raw tar.extract() to unpack .praison tar archives without validating the paths of archive members. This allows specially crafted .praison bundles containing relative path traversal entries (e.g., ../../) to write files outside the intended extraction directory, potentially overwriting arbitrary files on the victim's system. The issue is resolved in version 4.5.128.

An attacker who distributes a malicious .praison bundle can cause arbitrary files on the victim's filesystem to be overwritten when the victim runs the 'praisonai recipe unpack' command. This can lead to arbitrary code execution, denial of service, or system compromise depending on which files are overwritten. The vulnerability has a critical severity rating with a CVSS 4.0 score of 9.4. No known exploits in the wild have been reported as of the published date.

This vulnerability is fixed in PraisonAI version 4.5.128. Users should upgrade to version 4.5.128 or later to remediate this issue. Since no official patch link or advisory is provided, users should verify the update from the vendor's official channels. Until upgraded, avoid unpacking .praison bundles from untrusted sources to mitigate risk. Patch status is not explicitly confirmed beyond the stated fix version; check the vendor advisory for the latest remediation guidance.