CVE-2026-57137

HIGH 8.8

PraisonAI AgentLoop onToolCall approval runs after tool execution

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.

CWE	CWE-693 CWE-862 CWE-863
Vendor	mervinpraison
Product	praisonai
Published	Sep 15, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for mervinpraison praisonai

Be the first to know when new high vulnerabilities affecting mervinpraison praisonai are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

MervinPraison / PraisonAI

>= 1.4.0, < 1.7.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-h2w2-v7j6-xqm4 github.com: https://github.com/MervinPraison/PraisonAI/commit/6b4b59fbe71a74983626c7a0cf7e10c47cd004f9 github.com: https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62