CyberRota Analysis
AI-GeneratedPraisonAI versions 1.4.0 to 1.7.2 are vulnerable due to a flaw in the createAgentLoop() function, which allows executable tools to be processed before the onToolCall approval callback is invoked. This can lead to unauthorized execution of rejected operations, potentially causing unintended side effects such as file modifications or API calls. Organizations using affected versions should prioritize updating to version 1.7.2 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.