p PatchFirst

CVE-2026-56838

CVE-2026-56838 · PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.

CVSS 7.8 · High · Fix available

Published
Updated

Stack: python

Affected products and versions

  • praisonai

    Versions
    • >= 4.5.87, < 4.6.59: Affected

    No fix published

  • praisonai PyPI

    Versions
    • 4.5.100
    • 4.5.101
    • 4.5.102
    • 4.5.103
    • 4.5.104
    • 4.5.105
    • 4.5.106
    • 4.5.107
    • 4.5.108
    • 4.5.109
    • 4.5.110
    • 4.5.111
    • 4.5.112
    • 4.5.113
    • 4.5.114
    • 4.5.115
    • 4.5.117
    • 4.5.118
    • 4.5.119
    • 4.5.120
    • 4.5.121
    • 4.5.122
    • 4.5.123
    • 4.5.124
    • 4.5.125
    • 4.5.126
    • 4.5.127
    • 4.5.128
    • 4.5.129
    • 4.5.130
    • 4.5.131
    • 4.5.132
    • 4.5.133
    • 4.5.134
    • 4.5.135
    • 4.5.136
    • 4.5.137
    • 4.5.139
    • 4.5.140
    • 4.5.143
    • 4.5.144
    • 4.5.145
    • 4.5.149
    • 4.5.87
    • 4.5.88
    • 4.5.89
    • 4.5.90
    • 4.5.93
    • 4.5.94
    • 4.5.95
    • 4.5.96
    • 4.5.97
    • 4.5.98
    • 4.6.10
    • 4.6.11
    • 4.6.12
    • 4.6.13
    • 4.6.14
    • 4.6.15
    • 4.6.16
    • 4.6.18
    • 4.6.19
    • 4.6.20
    • 4.6.21
    • 4.6.22
    • 4.6.23
    • 4.6.24
    • 4.6.25
    • 4.6.26
    • 4.6.27
    • 4.6.28
    • 4.6.29
    • 4.6.30
    • 4.6.31
    • 4.6.32
    • 4.6.33
    • 4.6.34
    • 4.6.35
    • 4.6.36
    • 4.6.37
    • 4.6.38
    • 4.6.39
    • 4.6.40
    • 4.6.41
    • 4.6.42
    • 4.6.43
    • 4.6.44
    • 4.6.45
    • 4.6.46
    • 4.6.47
    • 4.6.48
    • 4.6.50
    • 4.6.51
    • 4.6.52
    • 4.6.53
    • 4.6.54
    • 4.6.55
    • 4.6.56
    • 4.6.57
    • 4.6.58
    • 4.6.9
    Affected ranges
    • ECOSYSTEM: ≥ 4.5.87, < 4.6.59

    Update to 4.6.59

Original sources

Check your server →