CVE-2026-57125
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.41%
- CWE
- CWE-306, CWE-863
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- MervinPraison PraisonAI
- MervinPraison praisonaiagents
Weakness type
Related vulnerabilities
- CVE-2026-67277 — Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
- CVE-2026-81735 — UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution
- CVE-2026-65956 — KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF
- CVE-2026-92808 — Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise
- CVE-2026-82695 — Tenda AC18 Telnet telnet missing authentication
- CVE-2026-82694 — Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication
- CVE-2026-82693 — Tenda AC1206 Web UI telnet TendaTelnet missing authentication
- CVE-2026-80462 — Privilege Escalation in Progress Chef Automate