CVE-2026-57125 Details
Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.
A remote code execution vulnerability has been identified in PraisonAI versions prior to 4.6.59 and in PraisonAI Agents versions prior to 1.6.59. The vulnerability exists in the Jobs API, specifically the POST /api/v1/runs endpoint, which does not require authentication. Attackers can exploit this by sending a crafted YAML payload that includes an 'approve' field, bypassing safety checks and allowing arbitrary operating system commands to be executed via the language model agent.
Users can upgrade to PraisonAI version 4.6.59 or PraisonAI Agents version 1.6.59, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4869-x4pr-q22x | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9 | [email protected] | Source CodeVendor |
| https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59 | [email protected] | Release NotesVendor |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4869-x4pr-q22x | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MervinPraison PraisonAI | <= 4.6.48 (semver) |
CPE
Remediation
| |
| MervinPraison PraisonAI Agents | <= 1.6.48 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |