What’s Vulnerable › Vulnerabilities

CVE-2026-56838: PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-23 · updated 2026-10-29
• Weakness: CWE-78

Description

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.

Affected products

• MervinPraison PraisonAI: from 4.5.87, < 4.6.59

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v847-hxxw-3pxg
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v847-hxxw-3pxg

Get alerted when CVE-2026-56838 or the next vulnerability affects your stack