CVE-2026-57137 Overview
CVE-2026-57137 is a security control bypass in PraisonAI, a multi-agent teams system. The flaw affects versions 1.4.0 through 1.7.1 and lives in the createAgentLoop() function in src/praisonai-ts/src/ai/agent-loop.ts. The function passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects. Applications relying on onToolCall as a human or policy approval boundary can execute rejected file, command, API, or data-modifying operations. The vulnerability is tracked under [CWE-693] Protection Mechanism Failure.
Critical Impact
Attackers or unintended agent actions can bypass human approval controls, executing file, command, or API operations before rejection is recorded.
Affected Products
- PraisonAI (praisonai-ts) versions 1.4.0 through 1.7.1
- Applications using onToolCall as an approval boundary
- Multi-agent workflows invoking createAgentLoop()
Discovery Timeline
- 2026-09-15 - CVE-2026-57137 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-57137
Vulnerability Analysis
The vulnerability stems from an ordering flaw between tool execution and approval enforcement. createAgentLoop() registers tool handlers with the wrapped AI SDK's generateText() function. The SDK invokes those handlers automatically as part of the model generation step. Only after generateText() returns does PraisonAI iterate over step.toolCalls and consult the onToolCall callback.
By that point, side effects have already occurred. A callback that returns false sets step.finishReason = 'tool_rejected' and terminates the loop, but denied tools have already written files, run commands, or modified state. Applications treating onToolCall as a policy enforcement point receive a false sense of security.
Root Cause
The root cause is an incorrect trust boundary. The approval callback executes after tool side effects rather than gating execution. This is a Protection Mechanism Failure [CWE-693]: the control exists but runs at the wrong point in the pipeline.
Attack Vector
An attacker with the ability to influence agent prompts, tool selection, or plan generation can trigger tools that a human reviewer or policy engine would reject. Because agents commonly wrap shell execution, file I/O, and API calls, the impact spans confidentiality, integrity, and availability.
// Patch excerpt from src/praisonai-ts/src/ai/agent-loop.ts
// Handle tool calls
if (step.toolCalls.length > 0) {
- // Check for approval if callback provided
- if (this.config.onToolCall) {
- for (const toolCall of step.toolCalls) {
- const approved = await this.config.onToolCall(toolCall);
- if (!approved) {
- this.complete = true;
- step.finishReason = 'tool_rejected';
- break;
- }
- }
+ // Rejection is handled in wrapped tool execute before execution
+ if (step.finishReason === 'tool_rejected') {
+ this.complete = true;
}
// Add tool call message
Source: GitHub Commit 6b4b59f
Detection Methods for CVE-2026-57137
Indicators of Compromise
- Agent execution logs showing tool side effects (file writes, shell commands) followed by a tool_rejected finish reason for the same step.
- Unexpected process launches, file modifications, or outbound API calls originating from PraisonAI worker processes.
- Audit records where onToolCall returned false yet downstream systems show state changes.
Detection Strategies
- Correlate PraisonAI application logs with host and cloud telemetry to identify tools that executed despite rejection.
- Compare the list of tools passed to generateText() against approvals recorded by the callback for each agent step.
- Alert on any agent step where step.finishReason === 'tool_rejected' is accompanied by populated toolResults.
Monitoring Recommendations
- Monitor sandbox executors and shell subprocesses spawned by PraisonAI agents for unexpected commands.
- Track filesystem and API mutations performed by service accounts used by agent runtimes.
- Enable verbose logging on the AI SDK tool execution path during incident response and threat hunting.
How to Mitigate CVE-2026-57137
Immediate Actions Required
- Upgrade praisonai-ts to version 1.7.2 or later, which relocates rejection enforcement to the wrapped tool execute handler.
- Audit existing agent logs for tools that executed despite onToolCall returning false.
- Rotate credentials or revert changes for any state-modifying tools invoked by affected agents.
Patch Information
The fix ships in PraisonAI release v4.6.62 and commit 6b4b59f. Details are documented in GitHub Security Advisory GHSA-h2w2-v7j6-xqm4. The patch moves rejection into the wrapped tool execute path so denied tools never run.
Workarounds
- Do not register privileged tools (shell, file write, network) with agent loops until the upgrade is applied.
- Wrap each tool's execute function with an inline approval check that halts before performing side effects.
- Run agents in a restricted sandbox with least-privilege filesystem, network, and credential access.
# Upgrade to patched version
npm install praisonai@^1.7.2
# Verify installed version
npm ls praisonai
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
