{"id":"CVE-2026-56838","kind":"vulnerability","aliases":["CVE-2026-56838"],"related":[],"title":"PraisonAI: streaming recipe path skips dangerous-tool check, runs execute_command","description":"PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.","summary":"PraisonAI's recipe.run_stream() path skips the dangerous-tool policy check that recipe.run() enforces, so a recipe declaring execute_command in TEMPLATE.yaml runs even when allow_dangerous_tools is False. An attacker who can get a recipe run through the streaming path can execute commands the default policy was meant to block.","severity":"high","cvss":7.8,"epss":0.002,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","praisonai","python"],"not_affected_if":["patched-version","recipe-run-only","trusted-recipes-only"],"how_to_check":"- Run `pip show praisonai` and check whether the version is from `4.5.87` up to but not including `4.6.59`.\n- Search your recipes and calling code for `run_stream(` to see whether untrusted or externally supplied recipes reach the streaming path.","fix":"- Upgrade PraisonAI to `4.6.59` or later.\n- Until upgraded, avoid calling `recipe.run_stream()` with recipes you do not fully trust.","status":"open","published_at":"2026-10-23T12:18:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T03:08:11+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:08:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PraisonAI to `4.6.59` or later.\n- Until upgraded, avoid calling `recipe.run_stream()` with recipes you do not fully trust.","reach":"unknown","title":"PraisonAI: streaming recipe path skips dangerous-tool check, runs execute_command","impact":"high","summary":"PraisonAI's recipe.run_stream() path skips the dangerous-tool policy check that recipe.run() enforces, so a recipe declaring execute_command in TEMPLATE.yaml runs even when allow_dangerous_tools is False. An attacker who can get a recipe run through the streaming path can execute commands the default policy was meant to block.","category":"ai-tooling","nicknames":[],"who_cares":["praisonai","python","ai-agents"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs shell commands on the host running the agent","analyst_note":"","how_to_check":"- Run `pip show praisonai` and check whether the version is from `4.5.87` up to but not including `4.6.59`.\n- Search your recipes and calling code for `run_stream(` to see whether untrusted or externally supplied recipes reach the streaming path.","needs_analyst":false,"not_affected_if":["patched-version","recipe-run-only","trusted-recipes-only"],"who_is_affected":"Teams running PraisonAI from `4.5.87` up to but not including `4.6.59` that execute recipes through recipe.run_stream(). Exposure depends on whether recipes come from untrusted sources; the sources do not say how an attacker would supply one. Teams on `4.6.59` or later, or who only use recipe.run(), are not affected.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000934,"input_tokens":3456,"output_tokens":1177,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-56838':15A,18A '4.5.87':90C '4.6.59':94C,184C 'agent':21B,85C 'ai':20B,23B 'ai-ag':19B 'ai-tool':22B 'allow':53B,109C,173C 'attack':59B 'block':79B,98C 'call':136C 'caller':106C 'check':9A,38B,120C,132C,146C 'command':12A,47B,72B,156C 'cve':13A,16A 'danger':7A,35B,54B,102C,110C,143C,174C 'dangerous-tool':6A,34B,142C 'declar':45B,154C 'default':74B,100C 'default-deni':99C 'deni':101C,161C 'depend':133C 'enforc':41B,117C 'engin':168C 'even':51B 'execut':11A,46B,71B,97C,137C,155C,167C 'explicit':107C 'fals':57B,176C 'get':62B 'honest':153C 'issu':178C 'load':128C 'meant':77B 'multi':84C 'multi-ag':83C 'normal':114C 'pass':108C 'patch':181C 'path':4A,31B,69B,116C,125C 'polici':37B,75B,122C,145C 'praisonai':1A,25B,27B,80C,95C 'python':26B 'reach':165C 'recip':3A,44B,64B,96C,131C,138C,151C 'recipe.run':29B,40B,115C,126C,163C,170C 'requires.tools':159C 'result':149C 'run':10A,50B,65B,140C 'skip':5A,32B 'stream':2A,30B,68B,124C,127C,171C 'system':87C 'team':86C 'template.yaml':49B,158C 'tool':8A,24B,36B,55B,103C,111C,121C,144C,175C 'true':112C 'unless':104C 'version':89C,93C,183C 'without':139C","nicknames":[],"mitigations":[],"who_affected":"Teams running PraisonAI from `4.5.87` up to but not including `4.6.59` that execute recipes through recipe.run_stream(). Exposure depends on whether recipes come from untrusted sources; the sources do not say how an attacker would supply one. Teams on `4.6.59` or later, or who only use recipe.run(), are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56838","severity":null,"published_at":"2026-10-23T12:18:15+00:00","modified_at":"2026-10-23T12:18:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-56838","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56838","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}