CVE-2026-40148

OVERVIEW CVE-2026-40148 is a denial-of-service vulnerability in PraisonAI versions prior to 4.5.128 that affects the recipe registry's archive extraction functionality. The _safe_extractall() function validates archive members against path traversal attacks but lacks protections against oversized files, cumulative extraction limits, or excessive member counts. This allows attackers to distribute malicious recipe bundles containing highly compressible payloads that expand to consume available disk space when extracted by users. SEVERITY The vulnerability carries a CVSS 3.1 score of 6.5 (MEDIUM) with a network-based attack vector requiring minimal complexity and no privileges, though it does require user interaction to pull a malicious recipe. The attack has no impact on confidentiality or integrity, but causes high availability impact through disk exhaustion. The EPSS score of 0.00037 indicates this vulnerability poses lower relative risk compared to other published CVEs. EXPLOITATION STATUS Currently, there is no evidence of active exploitation, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The FAUCET Risk Score of 35.0/100 suggests limited community attention or public exploit code availability. Organizations should prioritize updating PraisonAI to version 4.5.128 or later, though the absence of active exploitation provides a reasonable window for patching before immediate risk materializes.