PraisonAI policy bypass in recipe.run_stream

Executive brief

PraisonAI is an AI agent framework that allows users to run 'recipes' or automated workflows. A security flaw in the streaming execution mode allows dangerous tools (like system command execution) to run even when they are supposed to be blocked by default. If an attacker can provide a malicious recipe to the system, they could execute arbitrary commands with the privileges of the PraisonAI process, potentially leading to a full system compromise.

Technical details

A policy bypass exists in PraisonAI's recipe execution engine. While the standard 'recipe.run()' path correctly invokes '_check_tool_policy()' to block dangerous tools unless 'allow_dangerous_tools=True' is set, the 'recipe.run_stream()' path skips this check entirely. An attacker can exploit this by invoking the streaming API (POST /v1/recipes/stream) or the CLI with the '--stream' flag using a recipe that declares dangerous tools like 'execute_command'. This results in the execution of arbitrary system commands with the privileges of the application. The vulnerability is present in versions 4.5.87 through 4.6.58 and is fixed in version 4.6.59.

Affected products

• MervinPraison praisonai >= 4.5.87, <= 4.6.58

Timeline

• 2026-06-13: other: v4.6.57 released on PyPI
• 2026-06-17: advisory: GitHub Advisory published
• 2026-06-17: patched: Version 4.6.59 released

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D