CVE-2026-57142: PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allowdangeroustools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path loads workflow.yaml with YAMLWorkflowParser. That parser resolves agent-level tools: declarations and preserves top-level approve:. Workflow.start() then installs those YAML-approved tools into the approval context. As a result, an untrusted recipe can omit executecommand from TEMPLATE.yaml requires.tools, declare it in workflow.yaml agents..tools, and add top-level approve: [executecommand]. The caller did not set allowdangeroustools=True, but the recipe policy allows the recipe and the workflow approval path self-approves the critical shell tool. This issue has been patched in version 4.6.61.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.61
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Users who execute untrusted steps-based PraisonAI recipes are exposed if they use versions 4.5.87 through before 4.6.61. A malicious recipe can cause a dangerous shell-capable tool to be approved through its workflow.yaml configuration.
Does exploitation require the caller to enable dangerous tools?
No. The bypass works when the caller has not passed allow_dangerous_tools=True, because the recipe can omit the dangerous tool from TEMPLATE.yaml while declaring and approving it in workflow.yaml.
What must an attacker control to exploit this issue?
The attacker needs to supply or modify a steps-based recipe that is executed by PraisonAI. The recipe declares execute_command under workflow.yaml agent tools and adds it to the top-level approve list.
What version fixes the issue?
Version 4.6.61 includes the patch. Versions before 4.6.61, starting with 4.5.87, are affected.