PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.

Affected: PyPI: praisonai, PyPI: praisonaiagents

# Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI ## Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the `/api/v1/runs` endpoint requires no credentials, and a top-level `approve` field in the submitted YAML unconditionally bypasses the `@require_approval` safety decorator on dangerous tools such as `execute_command`. **Ecosystem:** pip | **Package:** `praisonai` | **Affected:** `<= 4.6.48` | **Patched:** *(none)* --- ## Details ### Step 1 — No authentication on the Jobs API `POST /api/v1/runs` accepts and executes agent jobs from any caller with no token or session required: ```python # src/praisonai/praisonai/jobs/router.py:47 @router.post("", response_model=JobSubmitResponse, status_code=202) async def submit_job( request: Request, body: JobSubmitRequest, # accepts agent_yaml from anyone ... # missing: _: None = Depends(verify_token) ): ``` Compare with the authenticated endpoint in `api/agent_invoke.py`, which correctly includes `Depends(verify_token)`. ### Step 2 — `approve` YAML field bypasses `@require_approval` The YAML parser extracts an attacker-controlled `approve` list and loads it into a ContextVar that the approval decorator consults before every tool call: ```python # src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py:261 approve_tools…

Affected: PyPI: praisonai

# Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI ## Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the `/api/v1/runs` endpoint requires no credentials, and a top-level `approve` field in the submitted YAML unconditionally bypasses the `@require_approval` safety decorator on dangerous tools such as `execute_command`. **Ecosystem:** pip | **Package:** `praisonai` | **Affected:** `<= 4.6.48` | **Patched:** *(none)* --- ## Details ### Step 1 — No authentication on the Jobs API `POST /api/v1/runs` accepts and executes agent jobs from any caller with no token or session required: ```python # src/praisonai/praisonai/jobs/router.py:47 @router.post("", response_model=JobSubmitResponse, status_code=202) async def submit_job( request: Request, body: JobSubmitRequest, # accepts agent_yaml from anyone ... # missing: _: None = Depends(verify_token) ): ``` Compare with the authenticated endpoint in `api/agent_invoke.py`, which correctly includes `Depends(verify_token)`. ### Step 2 — `approve` YAML field bypasses `@require_approval` The YAML parser extracts an attacker-controlled `approve` list and loads it into a ContextVar that the approval decorator consults before every tool call: ```python # src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py:261 approve_tools…