CVE-2026-56838: PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allowdangeroustools=True. The normal recipe.run() path enforces this with checktoolpolicy(). The streaming path, recipe.runstream(), loads the same recipe, checks dependencies, and then calls executerecipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares executecommand in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.runstream() with allowdangeroustools=False. This issue has been patched in version 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are affected?
PraisonAI versions 4.5.87 through versions before 4.6.59 are affected when recipes are executed through recipe.run_stream(). Version 4.6.59 contains the patch.
What must an attacker be able to do to exploit this?
Exploitation requires use of the recipe.run_stream() execution path with a recipe that declares a dangerous tool such as execute_command in TEMPLATE.yaml requires.tools. User interaction is required according to the supplied severity vector.
Are default dangerous-tool restrictions effective for streaming recipes?
No. In affected versions, recipe.run_stream() can reach the execution engine without the dangerous-tool policy check, even when allow_dangerous_tools=False. The equivalent recipe.run() path performs _check_tool_policy() and denies default-blocked dangerous tools.
What can be done before upgrading?
Avoid using recipe.run_stream() for recipes that may declare or invoke dangerous tools, particularly execute_command. Use recipe.run(), which enforces the dangerous-tool policy check, until upgrading to version 4.6.59.