CVE-2026-57125: PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agentyaml, and the approve field can mark executecommand as YAML-approved before @requireapproval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaito a version that resolves this vulnerability.Fixed in 4.6.59 - Upgrade
Upgrade
praisonaiagentsto a version that resolves this vulnerability.Fixed in 1.6.59
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments running versions earlier than praisonai 4.6.59 or praisonaiagents 1.6.59 are exposed if the Jobs API is reachable by a remote caller and a configured language model agent can be invoked. The attack does not require credentials or operator interaction.
What does an attacker need to submit to trigger command execution?
An attacker can send an unauthenticated POST request to /api/v1/runs containing attacker-controlled agent_yaml. The approve field can cause execute_command to be treated as YAML-approved before the approval checks for critical tools run.
Does the approval requirement protect vulnerable installations?
No. The vulnerability specifically bypasses the @require_approval protection for critical tools by marking execute_command as approved through the supplied YAML.
What versions address the issue?
Upgrade to praisonai 4.6.59 and praisonaiagents 1.6.59 or later. These are the fixed versions identified for the vulnerability.