CVE-2026-57137: PraisonAI AgentLoop onToolCall approval runs after tool execution
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records toolrejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAI AgentLoopto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Which deployments are exposed to meaningful impact?
Applications using createAgentLoop() and treating onToolCall as a human or policy approval boundary are exposed. The impact depends on the tools available to the agent, including tools that can modify files or data, run commands, or invoke external APIs.
What does an attacker need to exploit this behavior?
An attacker needs the ability to cause the agent to request a tool call that reaches a configured executable tool. No user interaction is required, but the affected application must expose a tool capable of producing side effects.
Are rejected tool calls safe in affected versions?
No. In affected versions, tool handlers can run during generateText() before onToolCall is invoked; returning false only records tool_rejected after side effects and toolResults may already exist.
What should be done if an immediate upgrade is not possible?
Do not rely on onToolCall to authorize side-effecting tools. Remove, disable, or externally enforce authorization for tools that execute commands, modify files or data, or call sensitive APIs until the affected AgentLoop behavior is remediated.
How can teams determine whether they may be affected?
Review whether the application uses createAgentLoop() with executable tools and an onToolCall callback that can deny calls. If so, inspect prior tool activity and toolResults because calls recorded as tool_rejected may already have executed.