CVE-2026-57137 in PraisonAI
Summary
by MITRE • 09/15/2026
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within PraisonAI versions ranging from 1.4.0 to 1.7.2 represents a critical failure in access control logic and execution sequencing for multi-agent systems that rely on external tool integrations. The core of the issue resides in the createAgentLoop function located at src/praisonai-ts/src/ai/agent-loop.ts, where the architectural design prioritizes immediate functional capability over security gating mechanisms. Specifically, when an AI agent determines a need to utilize a specific tool, such as one capable of executing system commands, modifying files, or interacting with external APIs, the framework passes these executable tools directly to the generateText function before invoking the onToolCall approval callback. This sequence creates a race condition where the underlying wrapped AI SDK executes the tool handlers during the text generation phase, effectively bypassing any intended human-in-the-loop or policy-based authorization checks that are supposed to occur via the callback mechanism.
From a technical perspective, this flaw constitutes an improper check before performing actions on behalf of another entity, which aligns with CWE-20: Improper Input Validation in its broader context of failing to validate intent prior to execution. More precisely, it is a classic example of CWE-841: Improvement of Insufficient Enforcement of Behavioral Restrictions because the system fails to enforce restrictions on how an agent can behave by allowing tool execution before policy evaluation. The operational impact is severe for any application utilizing PraisonAI as a foundation for autonomous agents that interact with sensitive environments. If developers rely on the onToolCall callback to implement security policies, such as requiring human approval for file deletions or command executions, those safeguards are rendered ineffective. A malicious actor who can influence the AI agent's output, through prompt injection or other manipulation techniques, could force the execution of arbitrary commands or data-modifying operations without any actual authorization being granted by the intended control layer.
The consequence is that denied tools result in a tool_rejected status only after they have already produced side effects and populated the toolResults array with their outputs. This means that destructive actions like deleting critical system files, exfiltrating sensitive data via API calls, or executing arbitrary shell commands may succeed before the rejection logic even registers the event. For organizations deploying these agents in production environments to handle financial transactions, manage infrastructure, or process personal data, this vulnerability exposes them to significant risk of unauthorized modification and potential compromise of underlying systems. The lack of atomicity between decision-making and execution means that rollback mechanisms would be required to mitigate damage after the fact, rather than preventing the action entirely as intended by the security architecture.
To address this issue, it is imperative for developers to upgrade immediately to version 1.7.2 or later, where PraisonAI has corrected the sequencing of tool invocation and approval callbacks. For those unable to update instantly due to dependency constraints, a temporary mitigation involves implementing additional validation layers outside of the standard callback flow, such as sandboxing agent environments with strict network egress rules and file system permissions that limit the blast radius of any unauthorized execution. Furthermore, security teams should review their use of AI agents against MITRE ATT&CK techniques related to command and script interpretation or data exfiltration over non-C2 protocols, ensuring that monitoring solutions are in place to detect anomalous tool usage patterns even if technical controls fail. This incident highlights the necessity for rigorous threat modeling when integrating autonomous systems with external execution capabilities, emphasizing that security checks must be enforced at the earliest possible point in the request lifecycle, prior to any side-effect-producing operations.