https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 04:43:30 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-57125 <p>PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.</p> <p>PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-57125 https://vulnerability.circl.lu/vuln/ghsa-4869-x4pr-q22x <p><strong>Affected:</strong> PyPI: praisonai, PyPI: praisonaiagents</p> <p># Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI ## Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the `/api/v1/runs` endpoint requires no credentials, and a top-level `approve` field in the submitted YAML unconditionally bypasses the `@require_approval` safety decorator on dangerous tools such as `execute_command`. **Ecosystem:** pip | **Package:** `praisonai` | **Affected:** `&lt;= 4.6.48` | **Patched:** *(none)* --- ## Details ### Step 1 — No authentication on the Jobs API `POST /api/v1/runs` accepts and executes agent jobs from any caller with no token or session required: ```python # src/praisonai/praisonai/jobs/router.py:47 @router.post(&#34;&#34;, response_model=JobSubmitResponse, status_code=202) async def submit_job( request: Request, body: JobSubmitRequest, # accepts agent_yaml from anyone ... # missing: _: None = Depends(verify_token) ): ``` Compare with the authenticated endpoint in `api/agent_invoke.py`, which correctly includes `Depends(verify_token)`. ### Step 2 — `approve` YAML field bypasses `@require_approval` The YAML parser extracts an attacker-controlled `approve` list and loads it into a ContextVar that the approval decorator consults before every tool call: ```python # src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py:261 approve_tools…</p> <p><strong>Affected:</strong> PyPI: praisonai, PyPI: praisonaiagents</p> <p># Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI ## Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the `/api/v1/runs` endpoint requires no credentials, and a top-level `approve` field in the submitted YAML unconditionally bypasses the `@require_approval` safety decorator on dangerous tools such as `execute_command`. **Ecosystem:** pip | **Package:** `praisonai` | **Affected:** `&lt;= 4.6.48` | **Patched:** *(none)* --- ## Details ### Step 1 — No authentication on the Jobs API `POST /api/v1/runs` accepts and executes agent jobs from any caller with no token or session required: ```python # src/praisonai/praisonai/jobs/router.py:47 @router.post(&#34;&#34;, response_model=JobSubmitResponse, status_code=202) async def submit_job( request: Request, body: JobSubmitRequest, # accepts agent_yaml from anyone ... # missing: _: None = Depends(verify_token) ): ``` Compare with the authenticated endpoint in `api/agent_invoke.py`, which correctly includes `Depends(verify_token)`. ### Step 2 — `approve` YAML field bypasses `@require_approval` The YAML parser extracts an attacker-controlled `approve` list and loads it into a ContextVar that the approval decorator consults before every tool call: ```python # src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py:261 approve_tools…</p> https://vulnerability.circl.lu/vuln/ghsa-4869-x4pr-q22x https://vulnerability.circl.lu/vuln/pysec-2026-3501 <p><strong>Affected:</strong> PyPI: praisonai</p> <p># Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI ## Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the `/api/v1/runs` endpoint requires no credentials, and a top-level `approve` field in the submitted YAML unconditionally bypasses the `@require_approval` safety decorator on dangerous tools such as `execute_command`. **Ecosystem:** pip | **Package:** `praisonai` | **Affected:** `&lt;= 4.6.48` | **Patched:** *(none)* --- ## Details ### Step 1 — No authentication on the Jobs API `POST /api/v1/runs` accepts and executes agent jobs from any caller with no token or session required: ```python # src/praisonai/praisonai/jobs/router.py:47 @router.post(&#34;&#34;, response_model=JobSubmitResponse, status_code=202) async def submit_job( request: Request, body: JobSubmitRequest, # accepts agent_yaml from anyone ... # missing: _: None = Depends(verify_token) ): ``` Compare with the authenticated endpoint in `api/agent_invoke.py`, which correctly includes `Depends(verify_token)`. ### Step 2 — `approve` YAML field bypasses `@require_approval` The YAML parser extracts an attacker-controlled `approve` list and loads it into a ContextVar that the approval decorator consults before every tool call: ```python # src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py:261 approve_tools…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p># Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI ## Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the `/api/v1/runs` endpoint requires no credentials, and a top-level `approve` field in the submitted YAML unconditionally bypasses the `@require_approval` safety decorator on dangerous tools such as `execute_command`. **Ecosystem:** pip | **Package:** `praisonai` | **Affected:** `&lt;= 4.6.48` | **Patched:** *(none)* --- ## Details ### Step 1 — No authentication on the Jobs API `POST /api/v1/runs` accepts and executes agent jobs from any caller with no token or session required: ```python # src/praisonai/praisonai/jobs/router.py:47 @router.post(&#34;&#34;, response_model=JobSubmitResponse, status_code=202) async def submit_job( request: Request, body: JobSubmitRequest, # accepts agent_yaml from anyone ... # missing: _: None = Depends(verify_token) ): ``` Compare with the authenticated endpoint in `api/agent_invoke.py`, which correctly includes `Depends(verify_token)`. ### Step 2 — `approve` YAML field bypasses `@require_approval` The YAML parser extracts an attacker-controlled `approve` list and loads it into a ContextVar that the approval decorator consults before every tool call: ```python # src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py:261 approve_tools…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3501