CVE-2026-57137

PraisonAI, an open-source multi-agent framework, contains a broken authorization/protection-mechanism flaw in the TypeScript agent loop: createAgentLoop() in praisonai-ts passes executable tool handlers to generateText() before consulting the onToolCall approval callback, and the underlying AI SDK runs tool handlers during generation. As a result, even when the operator's onToolCall callback returns false to deny a tool, the denied tool has already executed and its results are populated into toolResults, with 'tool_rejected' recorded only after the fact. An attacker who can influence the model's behavior (for example via prompt injection) or a low-privileged user of an affected application can cause file, shell-command, API, or data-modifying operations that the approval boundary was supposed to block, with high impact to confidentiality, integrity, and availability. Applications built on praisonai-ts versions 1.4.0 through before 1.7.2 that rely on onToolCall as a human or policy approval gate are affected. There is no public PoC, the flaw is not in CISA's KEV catalog, and no exploitation has been observed; the issue is fixed in version 1.7.2.

What to do: Upgrade praisonai-ts to version 1.7.2 or later, where the approval callback is enforced before tool execution. Until patched, do not treat onToolCall as a security boundary: run agents with least-privilege credentials, sandbox or stub file-system, shell, and API tools, and gate destructive tools outside the generation loop. Audit logs and toolResults for any 'tool_rejected' entries whose side effects may already have occurred and remediate accordingly.