{"id":"CVE-2026-57142","kind":"vulnerability","aliases":["CVE-2026-57142"],"related":[],"title":"PraisonAI: untrusted recipes self-approve shell execution, bypassing dangerous-tool policy","description":"PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_dangerous_tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path loads workflow.yaml with YAMLWorkflowParser. That parser resolves agent-level tools: declarations and preserves top-level approve:. Workflow.start() then installs those YAML-approved tools into the approval context. As a result, an untrusted recipe can omit execute_command from TEMPLATE.yaml requires.tools, declare it in workflow.yaml agents.*.tools, and add top-level approve: [execute_command]. The caller did not set allow_dangerous_tools=True, but the recipe policy allows the recipe and the workflow approval path self-approves the critical shell tool. This issue has been patched in version 4.6.61.","summary":"PraisonAI versions from 4.5.87 up to but not including 4.6.61 check dangerous-tool approval only against tools listed in TEMPLATE.yaml. A recipe can declare execute_command in workflow.yaml and approve it there, so an untrusted recipe runs the shell tool without the caller setting allow_dangerous_tools=True.","severity":"high","cvss":7.8,"epss":0.002,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","praisonai","python","self-hosted"],"not_affected_if":["patched-version","trusted-recipes-only"],"how_to_check":"- Check the installed PraisonAI version; versions `4.5.87` through below `4.6.61` are affected.\n- Look for steps-based recipes whose workflow.yaml has a top-level `approve:` entry listing `execute_command`, or whose `agents.*.tools` includes `execute_command`.","fix":"- Upgrade PraisonAI to `4.6.61` or later.\n- Until upgraded, run only recipes you trust and remove top-level `approve:` entries that list `execute_command` from any recipe you run.","status":"open","published_at":"2026-10-23T13:17:11+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T03:08:13+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:08:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PraisonAI to `4.6.61` or later.\n- Until upgraded, run only recipes you trust and remove top-level `approve:` entries that list `execute_command` from any recipe you run.","reach":"unknown","title":"PraisonAI: untrusted recipes self-approve shell execution, bypassing dangerous-tool policy","impact":"high","summary":"PraisonAI versions from 4.5.87 up to but not including 4.6.61 check dangerous-tool approval only against tools listed in TEMPLATE.yaml. A recipe can declare execute_command in workflow.yaml and approve it there, so an untrusted recipe runs the shell tool without the caller setting allow_dangerous_tools=True.","category":"ai-tooling","nicknames":[],"who_cares":["python","ai-agents","praisonai","self-hosted"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker-supplied recipe runs shell commands on the host without approval.","analyst_note":"","how_to_check":"- Check the installed PraisonAI version; versions `4.5.87` through below `4.6.61` are affected.\n- Look for steps-based recipes whose workflow.yaml has a top-level `approve:` entry listing `execute_command`, or whose `agents.*.tools` includes `execute_command`.","needs_analyst":false,"not_affected_if":["patched-version","trusted-recipes-only"],"who_is_affected":"Teams running PraisonAI 4.5.87 through 4.5.x and up to but not including 4.6.61 that execute steps-based recipes from sources they do not fully control. Teams that run only their own recipes or are already on 4.6.61 or later can skip this.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001141,"input_tokens":3546,"output_tokens":1572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-57142':16A,19A '4.5.87':34B,90C '4.6.61':40B,94C,232C 'actual':137C 'add':190C 'agent':22B,85C,148C,187C 'agent-level':147C 'ai':21B,24B 'ai-ag':20B 'ai-tool':23B 'allow':76B,118C,202C,210C 'approv':6A,45B,61B,157C,164C,168C,194C,216C,220C 'base':134C 'block':108C 'bypass':9A 'caller':74B,115C,198C 'check':41B,125C 'command':57B,179C,196C 'context':169C 'critic':222C 'cve':14A,17A 'danger':11A,43B,77B,101C,119C,203C 'dangerous-tool':10A,42B,100C 'declar':55B,127C,151C,183C 'default':110C 'default-deni':109C 'deni':111C 'execut':8A,56B,97C,138C,178C,195C 'explicit':116C 'host':30B 'includ':39B 'instal':160C 'issu':226C 'level':149C,156C,193C 'list':49B 'load':140C 'multi':84C 'multi-ag':83C 'omit':177C 'parser':145C 'pass':117C 'patch':229C 'path':139C,217C 'polici':13A,103C,123C,209C 'praisonai':1A,26B,31B,80C,95C 'preserv':153C 'python':27B 'recip':3A,53B,67B,96C,135C,175C,208C,212C 'requires.tools':130C,182C 'resolv':146C 'result':172C 'run':68B 'self':5A,29B,219C 'self-approv':4A,218C 'self-host':28B 'set':75B,201C 'shell':7A,70B,223C 'step':133C 'steps-bas':132C 'suppos':106C 'system':87C 'team':86C 'template.yaml':51B,129C,181C 'tool':12A,25B,44B,48B,71B,78B,102C,112C,120C,126C,150C,165C,188C,204C,224C 'top':155C,192C 'top-level':154C,191C 'true':79B,121C,205C 'unless':113C 'untrust':2A,66B,174C 'version':32B,89C,93C,231C 'without':72B 'workflow':215C 'workflow.start':158C 'workflow.yaml':59B,141C,186C 'yaml':163C 'yaml-approv':162C 'yamlworkflowpars':143C","nicknames":[],"mitigations":[],"who_affected":"Teams running PraisonAI 4.5.87 through 4.5.x and up to but not including 4.6.61 that execute steps-based recipes from sources they do not fully control. Teams that run only their own recipes or are already on 4.6.61 or later can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57142","severity":null,"published_at":"2026-10-23T13:17:11+00:00","modified_at":"2026-10-23T13:17:11+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-57142","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57142","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}