CVE-2026-57125 PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Remote attackers can execute arbitrary OS commands via the Jobs API by bypassing approval checks in PraisonAI libraries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57125?
CVE-2026-57125 is a critical command injection vulnerability in MervinPraison PraisonAI, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.
Which versions are affected by CVE-2026-57125?
6 open source packages ship an affected version, including praisonai and praisonaiagents.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | All versions | 4.6.59 |
praisonai PyPI | All versions | 4.6.59 |
praisonai PyPI | All versions | 4.6.59 |
praisonaiagents PyPI | All versions | 1.6.59 |
praisonaiagents PyPI | All versions | 1.6.59 |
praisonaiagents PyPI | All versions | 1.6.59 |
How do I fix CVE-2026-57125?
Upgrade praisonai to 4.6.59 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-57125 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57125 exists.
Sources
Also known as GHSA-4869-x4pr-q22x, PYSEC-2026-3501, PYSEC-2026-3529.