Live › vulnerability › CVE-2026-56838
Go to dashboardPraisonAI's recipe.run_stream() path skips the dangerous-tool policy check that recipe.run() enforces, so a recipe declaring execute_command in TEMPLATE.yaml runs even when allow_dangerous_tools is False. An attacker who can get a recipe run through the streaming path can execute commands the default policy was meant to block.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running PraisonAI from up to but not including that execute recipes through recipe.run_stream(). Exposure depends on whether recipes come from untrusted sources; the sources do not say how an attacker would supply one. Teams on or later, or who only use recipe.run(), are not affected.
4.5.874.6.594.6.59No product ranges from the sources yet.
pip show praisonai and check whether the version is from 4.5.87 up to but not including 4.6.59.run_stream( to see whether untrusted or externally supplied recipes reach the streaming path.4.6.59 or later.recipe.run_stream() with recipes you do not fully trust.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.
This page as .md · .json · in your agent: get_signal("CVE-2026-56838")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.