Description

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T15:17:05.900Z",
  "pubdate": "2026-09-14T15:17:05.900Z",
  "executiveSummary": "PraisonAI and praisonaiagents are affected by a critical vulnerability involving improper input validation and insufficient authorization controls within the Jobs API.\nThe vulnerability is classified as an improper authorization flaw, allowing for unauthenticated remote code execution (RCE).\nAffected products include praisonai versions prior to 4.6.59 and praisonaiagents versions prior to 1.6.59.\nThe flaw allows an unauthenticated remote attacker to supply a crafted agent_yaml configuration to the /api/v1/runs endpoint. By manipulating the 'approve' field, the attacker can bypass security checks designed to govern the execution of critical tools.\nThis leads to the unauthorized execution of arbitrary operating-system commands by the language model agent without any requirement for prior credentials or operator intervention.\nThe risk is critical, as it provides a vector for full system compromise, data exfiltration, and lateral movement within the hosting environment, given the agent's ability to interface directly with the underlying operating system.",
  "technicalDetails": "The vulnerability resides in the /api/v1/runs endpoint of the PraisonAI framework, specifically regarding how the system processes job requests submitted via POST operations.\nThe root cause is a flaw in the validation logic for incoming agent_yaml configuration payloads. The application fails to strictly sanitize or validate the 'approve' configuration parameter before the system processes the request.\nUnder normal operations, the @require_approval decorator is intended to act as a security gate, preventing unauthorized agents from invoking sensitive tools or executing commands on the host machine. However, the improper handling of the 'approve' field allows an attacker to manipulate the YAML structure to mark 'execute_command' operations as pre-approved.\nThe attack flow begins when an unauthenticated remote user sends a malicious POST request to /api/v1/runs. The request includes a payload where the 'agent_yaml' defines an agent capable of executing system-level operations. By setting the 'approve' field to a value that the backend incorrectly interprets as a valid authorization token or flag, the attacker forces the system to bypass the intended @require_approval gatekeeper function.\nOnce the gatekeeper is bypassed, the language model agent—which operates with the privileges of the application's service account—is instructed to execute the attacker-defined operating-system commands.\nBecause this endpoint is reachable without authentication, the attack requires no valid user session or API key, lowering the barrier to entry significantly. The payload behaves by triggering the internal workflow engine to invoke the subprocess module or equivalent command-execution utilities, which then execute arbitrary shell commands on the host server.\nThe post-exploitation impact is severe. Since the agent executes commands with the effective privileges of the praisonai process, the attacker can achieve remote code execution, perform file system manipulation, exfiltrate sensitive configuration files, or install persistence mechanisms, all while bypassing standard authorization workflows."
}