CVE-2026-57137
Deferred Deferred - Pending Action

Path Traversal in PraisonAI Agent Loop

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-10-05
AI Q&A
2026-09-15
EPSS Evaluated
2026-10-04
NVD
CVE-2026-57137
EUVD
EUVD-2026-78422

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
praisonai praisonai From 1.4.0 (inc) to 1.7.2 (inc)
mervinpraison praisonai From 1.4.0 (inc) to 1.7.1 (inc)
mervinpraison praisonai 1.7.2
mervinpraison praisonai 4.6.62

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in PraisonAI versions 1.4.0 to 1.7.2. The issue is in the createAgentLoop() function where executable tools are passed to generateText() before the onToolCall approval callback is invoked. The AI SDK executes tool handlers during generation, so even if onToolCall denies a tool, the tool has already run and caused side effects like file modifications or command executions.

Detection Guidance

This vulnerability cannot be directly detected via network or system commands as it is a logic flaw in the PraisonAI agent loop implementation. The issue involves improper tool execution timing where tools run before approval checks. To identify affected systems, check installed PraisonAI versions between 1.4.0 and 1.7.1 using commands like 'npm list praisonai' or 'pip show praisonai'. If the version falls in this range, the system is vulnerable.

Impact Analysis

If you use PraisonAI in this version range, attackers could exploit this to execute unauthorized tools that modify files, run commands, make API calls, or alter data. Since tools run before approval, sensitive operations could occur without your knowledge or consent, potentially leading to data breaches or system compromise.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR's data integrity principles or HIPAA's access controls. Unauthorized tool execution might lead to unauthorized data access, modification, or exfiltration, resulting in regulatory violations, fines, or legal consequences depending on the data processed.

Mitigation Strategies

Upgrade PraisonAI to version 1.7.2 or later to address the flawed tool approval mechanism in the agent loop. Review agent configurations to ensure onToolCall callbacks are enforced before tool execution. Monitor for unauthorized file, command, or API modifications as potential indicators of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart