PraisonAI CVE-2026-56838

Exploitation requires the vulnerable streaming entrypoint specifically: either the operator runs an attacker-chosen/untrusted recipe via praisonai recipe run <recipe> --stream, or a lower-trust user can invoke the recipe HTTP sidecar at POST /v1/recipes/stream. The recipe must declare a default-denied dangerous tool (e.g. execute_command) in TEMPLATE.yaml requires.tools; run_stream() then reaches _execute_recipe() with allow_dangerous_tools=False because the policy gate is never applied. LIMITING FACTORS: the standard recipe.run() path is NOT affected (it correctly returns POLICY_DENIED), so the bug only manifests through the streaming path; User Interaction is required (an operator must choose to run the recipe); for the HTTP sidecar path, exploitation additionally depends on the sidecar being exposed and reachable past its optional API-key/JWT authentication - the advisory does not claim default unauthenticated network RCE. The advisory also notes the exact command trigger depends on the workflow and model/tool-call path, though the policy boundary is already bypassed before execution.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates this High, but the vector itself tempers real-world urgency: the attack vector is Local and User Interaction is Required, meaning an operator must actively choose to run an attacker-supplied recipe through the streaming path. This is not remote-unauthenticated RCE - the advisory explicitly states it does NOT claim default unauthenticated network RCE. No CISA KEV listing is present, so there is no confirmed active exploitation. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. The vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with a serious-but-gated bug. SSVC-style reading: exploitation is 'none/proof-of-concept' (a local PoV is described), technical impact is Total (command execution as the PraisonAI process), but automatability is limited because it requires an operator or a lower-trust user to invoke a specific dangerous recipe through run_stream(). Net: this is a legitimate security-control bypass warranting prompt patching for anyone running untrusted recipes or exposing the recipe streaming sidecar, but the local/UI-gated vector and absence of KEV/EPSS signals mean it is a this-week priority rather than a drop-everything emergency. One caveat to verify: the elevated path (the documented HTTP sidecar at POST /v1/recipes/stream) could present as a network vector in exposed/authenticated deployments, which would raise AV to Network for those configurations.

An operator runs an untrusted PraisonAI recipe (or exposes the recipe streaming sidecar to lower-trust users) and invokes it via the streaming path - praisonai recipe run <recipe> --stream or POST /v1/recipes/stream. Because run_stream() never calls _check_tool_policy(), a recipe honestly declaring execute_command in TEMPLATE.yaml requires.tools reaches _execute_recipe() even though allow_dangerous_tools remains False, letting OS commands run with the privileges of the PraisonAI process. A local proof-of-vulnerability (a printf canary that crosses the policy boundary) is described in the GHSA advisory.