SCA: security update for PraisonAI (GHSA-4rx4-4r3x-6534)

high Tenable Cloud Security Plugin ID 440022

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry pull flow extracts
attacker-controlled .praison tar archives with tar.extractall() and does not validate archive member paths
before extraction. A malicious publisher can upload a recipe bundle that contains ../ traversal entries
and any user who later pulls that recipe will write files outside the output directory they selected. This
is a path traversal / arbitrary file write vulnerability on the client side of the recipe registry
workflow. It affects both the local registry pull path and the HTTP registry pull path. The checksum
verification does not prevent exploitation because the malicious traversal payload is part of the signed
bundle itself. This vulnerability is fixed in 1.5.113. (CVE-2026-39306)

Solution

Update the PraisonAI library and its related packages to version 4.5.113 or later.

Plugin Details

Severity: High

ID: 440022

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 4/8/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.59

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C

CVSS Score Source: CVE-2026-39306

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/6/2026

Vulnerability Publication Date: 4/6/2026

Reference Information

CVE: CVE-2026-39306

cwe: CWE-22

Detections

Analytics