CVE-2026-57125: PraisonAI unauthenticated remote code execution via /api/v1/runs

CVE-2026-57125 · Severity: critical · CVSS 9.8 · Published 2026-09-14

PraisonAI is a multi-agent system that orchestrates AI workflows using language models and tools. An unauthenticated attacker can send a malicious POST request to the /api/v1/runs API endpoint to inject arbitrary operating system commands, bypassing safety checks and causing the configured AI agent to execute those commands with the application's privileges. This results in complete system compromise with no authentication or user interaction required.

Technologies: praisonai (PyPI), praisonaiagents (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-57125 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57125 being exploited in the wild.
How severe is CVE-2026-57125?
Critical severity, with a CVSS score of 9.8, published 14 September 2026.
Which products and versions are affected?
praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.59; praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.59.
Is there a fix for CVE-2026-57125?
Yes. praisonai (PyPI): upgrade to 4.6.59 or later; praisonaiagents (PyPI): upgrade to 1.6.59 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57125 attacked?
It is attacked over the network.
Am I affected by CVE-2026-57125?
Check whether you run praisonai (PyPI) or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai (PyPI): upgrade to 4.6.59 or later
    pip install "praisonai>=4.6.59"
  • praisonaiagents (PyPI): upgrade to 1.6.59 or later
    pip install "praisonaiagents>=1.6.59"

Technical details

The vulnerability is an authentication bypass and arbitrary command execution chain in the /api/v1/runs POST endpoint. An unauthenticated attacker can submit a crafted request containing a malicious agent_yaml payload with an approve field that pre-marks execute_command tools as "YAML-approved" before the @require_approval decorator performs critical tool safety checks. The vulnerable code logic allows the approval status to be set via attacker-controlled input, bypassing intended access control mechanisms. This enables remote code execution as the application user without credentials or operator consent. The fix (praisonai 4.6.59 and praisonaiagents 1.6.59) hardens input validation and access controls, properly enforcing approval requirements for critical tools.

Affected products

  • PraisonAI PraisonAI prior to 4.6.59
  • PraisonAI PraisonAI Agents prior to 1.6.59

Identifiers

  • CVE-2026-57125
  • GHSA-4869-x4pr-q22x
  • PYSEC-2026-3501
  • PYSEC-2026-3529

Timeline

  • 2026-09-14: disclosed: CVE-2026-57125 published
  • 2026-06-13: patched: Fix committed to repository
  • 2026-06-17: other: v4.6.59 released with security patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.