CVE-2026-56838: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MervinPraison PraisonAI

PraisonAI is a multi-agent teams system where recipe execution blocks dangerous tools by default unless explicitly allowed. Between versions 4.5.87 and before 4.6.59, the streaming execution method recipe.run_stream() bypasses the dangerous tool policy check (_check_tool_policy()), allowing execution of commands that should be denied. This discrepancy enables OS command injection via recipes that declare execute_command in TEMPLATE.yaml requires.tools, which are blocked in the normal execution path but allowed in the streaming path without the allow_dangerous_tools flag. The issue is fixed in version 4.6.59.

An attacker can exploit this vulnerability to execute arbitrary OS commands through the streaming execution path, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 7.8 reflects a high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade PraisonAI to version 4.6.59 or later, where the dangerous tool policy check is enforced consistently across all execution paths, including recipe.run_stream(). No other mitigation is indicated by the vendor advisory.