CVE-2026-57125

PraisonAI, an open-source multi-agent LLM framework, contains a critical authorization flaw (CVSS 9.8) in its unauthenticated POST /api/v1/runs Jobs API endpoint. A remote attacker can submit a request containing attacker-controlled agent_yaml and set the approve field to pre-approve the execute_command tool, bypassing the @require_approval check before it evaluates critical tools. This chain causes the configured language-model agent to invoke arbitrary operating-system commands on the host with no credentials and no operator interaction, giving the attacker full compromise of confidentiality, integrity, and availability. All deployments running praisonai before 4.6.59 or praisonaiagents before 1.6.59 that expose the Jobs API to a network are affected; the issue is fixed in those two releases. No public proof-of-concept is known and the vulnerability is not in CISA's KEV catalog, so exploitation in the wild appears unlikely at this time.

What to do: Upgrade praisonai to 4.6.59 or later and praisonaiagents to 1.6.59 or later immediately. If patching is delayed, ensure the Jobs API is not reachable by untrusted callers — bind it to localhost or place it behind an authenticated reverse proxy or VPN. Review server logs for unexpected POST /api/v1/runs requests containing agent_yaml or approve fields and investigate any resulting command executions for signs of compromise.