CVE-2026-57137
Received Received - Intake

Path Traversal in PraisonAI Agent Loop

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-57137
EUVD
EUVD-2026-78422

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
praisonai praisonai From 1.4.0 (inc) to 1.7.2 (inc)
mervinpraison praisonai From 1.4.0 (inc) to 1.7.1 (inc)
mervinpraison praisonai 1.7.2
mervinpraison praisonai 4.6.62

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in PraisonAI versions 1.4.0 to 1.7.2. The issue is in the createAgentLoop() function where executable tools are passed to generateText() before the onToolCall approval callback is invoked. The AI SDK executes tool handlers during generation, so even if onToolCall denies a tool, the tool has already run and caused side effects like file modifications or command executions.

Impact Analysis

If you use PraisonAI in this version range, attackers could exploit this to execute unauthorized tools that modify files, run commands, make API calls, or alter data. Since tools run before approval, sensitive operations could occur without your knowledge or consent, potentially leading to data breaches or system compromise.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR's data integrity principles or HIPAA's access controls. Unauthorized tool execution might lead to unauthorized data access, modification, or exfiltration, resulting in regulatory violations, fines, or legal consequences depending on the data processed.

Mitigation Strategies

Upgrade PraisonAI to version 1.7.2 or later to address the flawed tool approval mechanism in the agent loop. Review agent configurations to ensure onToolCall callbacks are enforced before tool execution. Monitor for unauthorized file, command, or API modifications as potential indicators of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart