CVE-2026-57137 Details
Description
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.
A vulnerability exists in the PraisonAI npm package, specifically in the TypeScript AgentLoop component, versions 1.4.0 through 1.7.1. The issue arises because the createAgentLoop() function passes executable tools to the generateText() method before calling the onToolCall approval callback. This sequence allows tools to be executed and produce side effects before they can be rejected, creating a false security signal. As a result, applications that use this approval mechanism can inadvertently execute rejected operations that modify data, call APIs, or perform other sensitive actions.
Users can update to PraisonAI version 1.7.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-h2w2-v7j6-xqm4 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/MervinPraison/PraisonAI/commit/6b4b59fbe71a74983626c7a0cf7e10c47cd004f9 | [email protected] | Source CodeVendor |
| https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62 | [email protected] | Vendor |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-h2w2-v7j6-xqm4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MervinPraison/PraisonAI | >= 1.4.0, <= 1.7.1 (semver) |
CPE
Remediation
| |
| npm:praisonai | >= 1.4.0, <= 1.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |