CVE-2026-56838— PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI 是一个多智能体团队协作系统。在版本 4.5.87 至 4.6.59（不含）之间，PraisonAI 的配方（recipe）执行机制默认禁止危险工具，除非调用方显式传入 。正常的 执行路径通过 函数强制执行该策略。然而，流式执行路径 在加载相同配方并检查依赖项后，直接调用 ，却未执行危险工具策略检查。因此，若某个配方在 的 字段中如实声明了 ，该配方在通过 执行时会被拒绝，但通过 执行时，即使 ，仍会绕过策略检查并进入执行引擎。该问题已在版本 4.6.59 中修复。
Possible ATT&CK Techniques 3 AI
T1203 · Exploitation for Client Execution T1059 · Command and Scripting Interpreter T1059.004 · Unix ShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.5.87, < 4.6.59 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-56838
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.5.87, < 4.6.59 | - |
|
II. Public POCs for CVE-2026-56838
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56838
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56838 (1)
Same Patch Batch · MervinPraison · 2026-10-23 · 16 CVEs total
| CVE-2026-57116 | 9.8 CRITICAL | PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remo |
| CVE-2026-56832 | 8.8 HIGH | PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals |
| CVE-2026-56840 | 8.8 HIGH | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-pa |
| CVE-2026-57117 | 8.8 HIGH | PraisonAI: Compute-bridged file tools allow shell command injection |
| CVE-2026-57144 | 8.8 HIGH | PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is |
| CVE-2026-56837 | 8.6 HIGH | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing |
| CVE-2026-56835 | 8.3 HIGH | PraisonAI Slack app_mention bypasses configured user/channel authorization |
| CVE-2026-56836 | 8.2 HIGH | PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard |
| CVE-2026-57113 | 8.1 HIGH | PraisonAI GitHub template cache path traversal allows outside-cache file write and directo |
| CVE-2026-57121 | 8.1 HIGH | PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' co |
| CVE-2026-57142 | 7.8 HIGH | PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous |
| CVE-2026-56833 | 7.5 HIGH | PraisonAI Dynamic Context history and terminal tools read files outside configured storage |
| CVE-2026-56834 | 7.5 HIGH | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storag |
| CVE-2026-57146 | 7.5 HIGH | PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated b |
| CVE-2026-57114 | 7.2 HIGH | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding |
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow
Same vendor: MervinPraison
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow
Same weakness: CWE-78
-
CVE-2026-115586
virtualenv: Bash activator leaves the --prompt value unescap -
CVE-2026-39902
Cacti: Authenticated RCE on Data Input -
CVE-2026-114355
DJI CrystalSky ZS600C hardware_monitor evaluates attacker-co -
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin
V. Comments for CVE-2026-56838
No comments yet