CVE-2026-57125 PUBLISHED

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Assigner: GitHub_M
Reserved: 24.06.2026 Published: 14.09.2026 Updated: 14.09.2026

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor MervinPraison
Product PraisonAI
Versions
  • Version < 4.6.59 is affected
Vendor MervinPraison
Product praisonaiagents
Versions
  • Version < 1.6.59 is affected

References

Problem Types

  • CWE-306: Missing Authentication for Critical Function CWE
  • CWE-863: Incorrect Authorization CWE