---
id: "CVE-2026-57142"
kind: "vulnerability"
aliases: ["CVE-2026-57142"]
title: "PraisonAI: untrusted recipes self-approve shell execution, bypassing dangerous-tool policy"
severity: "high"
cvss: 7.8
epss: 0.002
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "praisonai", "python", "self-hosted"]
not_affected_if: ["patched-version", "trusted-recipes-only"]
published_at: "2026-10-23T13:17:11+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57142", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-57142", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# PraisonAI: untrusted recipes self-approve shell execution, bypassing dangerous-tool policy

PraisonAI versions from 4.5.87 up to but not including 4.6.61 check dangerous-tool approval only against tools listed in TEMPLATE.yaml. A recipe can declare execute_command in workflow.yaml and approve it there, so an untrusted recipe runs the shell tool without the caller setting allow_dangerous_tools=True.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PraisonAI version; versions `4.5.87` through below `4.6.61` are affected.
- Look for steps-based recipes whose workflow.yaml has a top-level `approve:` entry listing `execute_command`, or whose `agents.*.tools` includes `execute_command`.

## Fix

- Upgrade PraisonAI to `4.6.61` or later.
- Until upgraded, run only recipes you trust and remove top-level `approve:` entries that list `execute_command` from any recipe you run.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57142
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-57142

## From the sources

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_dangerous_tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path loads workflow.yaml with YAMLWorkflowParser. That parser resolves agent-level tools: declarations and preserves top-level approve:. Workflow.start() then installs those YAML-approved tools into the approval context. As a result, an untrusted recipe can omit execute_command from TEMPLATE.yaml requires.tools, declare it in workflow.yaml agents.*.tools, and add top-level approve: [execute_command]. The caller did not set allow_dangerous_tools=True, but the recipe policy allows the recipe and the workflow approval path self-approves the critical shell tool. This issue has been patched in version 4.6.61.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_