MervinPraison PraisonAI policy bypass in recipe workflow tools

Executive brief

PraisonAI, an AI agent framework, contains a security flaw where malicious task recipes can bypass safety restrictions to run dangerous system commands. Normally, the software blocks high-risk tools unless a user explicitly enables them, but a recipe can "self-approve" these tools by hiding them in specific configuration files. This could allow an attacker to execute arbitrary code on a user's machine if the user runs an untrusted recipe.

Technical details

A policy bypass exists in PraisonAI's tool enforcement mechanism. The `_check_tool_policy()` function only validates tools declared in `TEMPLATE.yaml`, but the `YAMLWorkflowParser` used for steps-based recipes resolves agent-level tools and top-level `approve:` declarations from `workflow.yaml`. An attacker can omit a dangerous tool like `execute_command` from the template while including and self-approving it in the workflow file. This bypasses the `allow_dangerous_tools=True` requirement, allowing arbitrary command execution with the privileges of the PraisonAI process. The vulnerability is patched in version 4.6.61.

Affected products

• MervinPraison praisonai >= 4.5.87, < 4.6.61

Timeline

• 2026-06-17: disclosed
• 2026-06-17: advisory
• 2026-06-18: patched

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D