CVE-2026-57125
Deferred Deferred - Pending Action

Command Injection in PraisonAI via Unauthenticated API

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-57125
EUVD
EUVD-2026-77531

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
praisonai praisonai 4.6.59
praisonai praisonaiagents 1.6.59
praisonai praisonai to 4.6.48 (exc)
praisonai praisonaiagents to 1.6.48 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57125 is a critical vulnerability in PraisonAI versions before 4.6.59 and praisonaiagents before 1.6.59. It allows unauthenticated remote attackers to execute arbitrary operating-system commands via the Jobs API. The flaw exists because the /api/v1/runs endpoint accepts attacker-controlled YAML input and an approve field that bypasses required approval checks for dangerous tools like execute_command.

Detection Guidance

Check if your PraisonAI or PraisonAIAgents versions are below 4.6.59 or 1.6.59 respectively. Inspect network traffic for POST requests to /api/v1/runs with agent_yaml payloads containing execute_command. Monitor for unexpected command execution logs or system changes.

Impact Analysis

This vulnerability allows remote attackers to run any command on the affected system without authentication or user interaction. This could lead to full system compromise, unauthorized data access, data theft, service disruption, or installation of malware. Attackers could steal sensitive information, modify system configurations, or use the system as a launchpad for further attacks.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to personal or protected health data. GDPR requires protection of personal data and breach notification; HIPAA mandates safeguards for protected health information. Exploitation could result in data breaches, leading to regulatory fines, legal liabilities, and reputational damage for organizations handling sensitive data.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.59 or later and PraisonAIAgents to 1.6.59 or later. Restrict network access to the /api/v1/runs endpoint. Review and remove any unauthenticated access configurations for this API.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57125. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart