PraisonAI CVE-2026-57125

Exploitation requires only that the PraisonAI Jobs API (POST /api/v1/runs, default port 8005) be network-reachable - it enforces no token or session, matching PR:N. There are no non-default configuration prerequisites: the vulnerable endpoint ships without the verify_token dependency used by the authenticated agent_invoke endpoint, and the 'approve' YAML field bypass works against the default @require_approval safety decorator on execute_command. The only real limiting factor is deployment exposure: the Jobs API must be running and accessible to the attacker (internet- or network-exposed), and the agent must have the execute_command (critical) tool available. No user interaction, credentials, or operator approval is needed.

This is a genuine top-priority vulnerability, and the CVSS 9.8 is well-calibrated rather than inflated. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is fully consistent with the description and the vendor advisory: a network-reachable, unauthenticated endpoint (POST /api/v1/runs, missing the Depends(verify_token) present on the sibling authenticated endpoint) chains with an approval-decorator bypass (attacker-controlled top-level 'approve' YAML field pre-marks execute_command as approved before @require_approval's critical-risk check) to yield arbitrary OS command execution - i.e., full C/I/A on the host. SSVC reinforces this: Exploitation:poc, Automatable:yes, Technical Impact:total. A working PoC (curl one-liner) is embedded in the GHSA advisory, so publicly available exploit code exists. The one signal that runs slightly counter is EPSS at 0.41% (35th percentile), which is modest - but EPSS reflects observed/predicted mass-exploitation volume for a niche package, not the ease of exploitation, so it should not lower the operational priority for anyone actually running the Jobs API. There is no CISA KEV listing, so despite the trivial, automatable, unauthenticated RCE this is not yet confirmed as actively exploited in the wild; it should be treated as imminently exploitable rather than known-exploited.

A remote attacker with no credentials sends a single crafted HTTP POST to the exposed PraisonAI Jobs API (/api/v1/runs) containing an agent_yaml payload that both defines a workflow invoking execute_command and includes a top-level 'approve: [execute_command]' entry, which silently neutralizes the critical-tool approval gate. The configured LLM agent then runs the attacker's OS commands on the server with no operator interaction. A functional proof-of-concept curl request is published in the GHSA-4869-x4pr-q22x advisory, making exploitation trivial to reproduce.