PraisonAI: Dangerous-tool policy bypass in recipe streaming
Summary
PraisonAI, a multi-agent teams system, skips its default block on dangerous tools in the recipe streaming path. A recipe that declares execute_command in TEMPLATE.yaml is denied by recipe.run() but still reaches execution through recipe.run_stream() without allow_dangerous_tools=True. If the workflow reaches the approved execute_command call, commands run with the privileges of the PraisonAI process. The CLI option --stream and the recipe HTTP endpoint POST /v1/recipes/stream are affected.
Affected
- praisonai (PyPI) from 4.5.87 up to, but not including, 4.6.59
Fixed in
- Upgrade to praisonai 4.6.59 or later
Workaround
Unknown. No vendor workaround documented. Interim measures: do not run untrusted recipes via streaming, restrict access to the recipe HTTP server, and review auto-approval settings.
Exploitation
- CISA SSVC: proof of concept available, not automatable
- The advisory describes a local validation test that uses a harmless marker command
- No evidence of in-the-wild exploitation found
- EPSS is low (about 0.00146, per EUVD mirror)
Our recommendation
- Upgrade to praisonai 4.6.59 or later
- Until patched, do not run recipes from untrusted sources through streaming or the /v1/recipes/stream endpoint
- Restrict network access to the recipe HTTP server and review auto-approval settings
- Monitor for unexpected command execution by the PraisonAI process
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v847-hxxw-3pxg github.com
- OSV: GHSA-v847-hxxw-3pxg osv.dev
- OSV: PYSEC-2026-3520 osv.dev
- Vulners: NVD record CVE-2026-56838 vulners.com
- Strix: CVE-2026-56838 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:42.
Original description (NVD)
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.