# CVE-2026-57142: PraisonAI recipe policy bypass via YAML-approved tools

Source: https://junglewise.ai/threats/cve-2026-57142-praisonai-recipe-workflow-policy-can-be-bypassed-by-declaring-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-57142 · Severity: high · CVSS 7.8 · Published 2026-10-23

PraisonAI is a system for orchestrating multi-agent AI workflows. It has a safety mechanism that blocks dangerous shell commands unless explicitly permitted by the operator. An attacker can bypass this check by declaring the dangerous tool in the workflow definition rather than the recipe template, and self-approving it, allowing arbitrary command execution without the operator's consent.

Technologies: [MervinPraison PraisonAI](https://junglewise.ai/threats/technologies/mervinpraison-praisonai), [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai). Vendors: [MervinPraison](https://junglewise.ai/threats/vendors/mervinpraison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-57142 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57142 being exploited in the wild.

**How severe is CVE-2026-57142?** High severity, with a CVSS score of 7.8, published 23 October 2026.

**Which products and versions are affected?** MervinPraison PraisonAI 4.5.87 to before 4.6.61; praisonai (PyPI) ECOSYSTEM:introduced=4.5.87,fixed=4.6.61.

**Is there a fix for CVE-2026-57142?** Yes. praisonai (PyPI): upgrade to 4.6.61 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57142 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-57142?** Check whether you run MervinPraison PraisonAI or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonai (PyPI): upgrade to 4.6.61 or later

  ```sh
  pip install "praisonai>=4.6.61"
  ```


## Technical details

The vulnerability exists in recipe-level dangerous-tool policy enforcement, which only inspects TEMPLATE.yaml requires.tools but not the workflow.yaml file that is actually executed. An untrusted recipe can omit execute_command from TEMPLATE.yaml, declare it in workflow.yaml agents.*.tools, add a top-level approve: [execute_command] directive, and bypass the allow_dangerous_tools=True check. The YAMLWorkflowParser preserves the approve: directive and installs it into the approval context, self-approving the critical shell tool at workflow initialization time.

## Affected products

- MervinPraison PraisonAI 4.5.87 to before 4.6.61

## Identifiers

- CVE-2026-57142
- GHSA-7qw2-w5rc-37x2
- PYSEC-2026-3505

## Timeline

- 2026-06-17: disclosed
- 2026-10-23: advisory

## References

- [https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7qw2-w5rc-37x2](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7qw2-w5rc-37x2)

## Related threats

- [PraisonAI authentication bypass in A2U event streaming](https://junglewise.ai/threats/cve-2026-57146-praisonai-a2u-incomplete-authentication-fix-leaves-current-serve)
- [PraisonAI sandbox escape when Landlock unavailable](https://junglewise.ai/threats/cve-2026-57144-praisonai-sandlocksandbox-falls-back-to-unrestricted-subprocess)
- [PraisonAI shell command injection in compute-bridged file tools](https://junglewise.ai/threats/cve-2026-57117-praisonai-compute-bridged-file-tools-allow-shell-command)
- [PraisonAI AgentOS authentication bypass in FastAPI deployment](https://junglewise.ai/threats/cve-2026-57116-praisonai-agentos-remains-unauthenticated-after-incomplete-fix)
- [PraisonAI Jobs webhook SSRF via DNS rebinding](https://junglewise.ai/threats/cve-2026-57114-praisonai-jobs-webhook-ssrf-protection-bypass-via-dns-rebinding)