CyberRota Analysis
AI-GeneratedPraisonAI's multi-agent teams system is vulnerable due to the absence of the @require_approval decorator in the ast_grep_rewrite function prior to version 1.6.58, allowing unauthorized agents to rewrite files when the dry_run parameter is set to False. This could lead to unauthorized modifications of critical files, posing a risk to system integrity and data security. Organizations using versions before 1.6.58 should prioritize upgrading to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval decorator used by sibling mutation tools. With dry_run=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected authorization gate. This issue is fixed in version 1.6.58.