PT-2026-61796 · Praisonai · Praisonai
CVE-2026-57142
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
praisonai versions 4.5.87 through 4.6.57
Description
A policy bypass exists in the recipe execution process where the dangerous-tool policy fails to inspect the workflow file. While the system is designed to block default-denied tools unless
allow dangerous tools=True is passed, it only validates tools declared in the TEMPLATE.yaml requires.tools section. An untrusted recipe can bypass this by omitting the tool from TEMPLATE.yaml and instead declaring it within workflow.yaml under agents.*.tools while adding a top-level approve: entry. This allows the recipe to self-approve critical shell tools, such as execute command(), leading to potential remote code execution with the privileges of the PraisonAI process.Recommendations
Update praisonai to a version newer than 4.6.57.
As a temporary mitigation, avoid running untrusted recipes or exposing the recipe runner to users who can specify recipe names or URIs.
Restrict the use of the
execute command() function by ensuring allow dangerous tools is set to False and auditing workflow.yaml files for unauthorized approve: entries.Fix
OS Command Injection
Code Injection
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai