Live › vulnerability › CVE-2026-57142
Go to dashboardPraisonAI versions from 4.5.87 up to but not including 4.6.61 check dangerous-tool approval only against tools listed in TEMPLATE.yaml. A recipe can declare execute_command in workflow.yaml and approve it there, so an untrusted recipe runs the shell tool without the caller setting allow_dangerous_tools=True.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running PraisonAI 4.5.87 through 4.5.x and up to but not including 4.6.61 that execute steps-based recipes from sources they do not fully control. Teams that run only their own recipes or are already on 4.6.61 or later can skip this.
No product ranges from the sources yet.
4.5.87 through below 4.6.61 are affected.approve: entry listing execute_command, or whose agents.*.tools includes execute_command.4.6.61 or later.approve: entries that list execute_command from any recipe you run.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_dangerous_tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path loads workflow.yaml with YAMLWorkflowParser. That parser resolves agent-level tools: declarations and preserves top-level approve:. Workflow.start() then installs those YAML-approved tools into the approval context. As a result, an untrusted recipe can omit execute_command from TEMPLATE.yaml requires.tools, declare it in workflow.yaml agents.*.tools, and add top-level approve: [execute_command]. The caller did not set allow_dangerous_tools=True, but the recipe policy allows the recipe and the workflow approval path self-approves the critical shell tool. This issue has been patched in version 4.6.61.
This page as .md · .json · in your agent: get_signal("CVE-2026-57142")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.