PT-2026-61763 · Praisonai · Praisonai
CVE-2026-56838
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PraisonAI versions 4.5.87 through 4.6.57
Description
The
recipe.run stream() function fails to enforce the dangerous-tool policy, allowing recipes to execute tools that are denied by default. While the standard recipe.run() path uses check tool policy() to block risky tools unless allow dangerous tools is set to true, the streaming path bypasses this check and proceeds directly to execute recipe(). This allows a recipe that declares dangerous tools, such as execute command, to be executed even when allow dangerous tools is false. This issue is accessible via the CLI using the --stream flag or through the HTTP API endpoint POST /v1/recipes/stream. If an untrusted recipe is run in streaming mode, it can execute commands with the privileges of the PraisonAI process.Recommendations
For versions 4.5.87 through 4.6.57, implement the
check tool policy() function within run stream() to ensure the policy is enforced before execution and dry-runs.
As a temporary mitigation, avoid using the POST /v1/recipes/stream endpoint or the --stream CLI flag when running untrusted recipes.
Restrict access to the execute command tool in recipe configurations to minimize the risk of unauthorized command execution.Fix
OS Command Injection
Protection Mechanism Failure
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai