CVE-2026-57137

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.

Summary

The published npm package praisonai exports createAgentLoop(), whose onToolCall callback is documented and exampled as an approval hook. The implementation calls PraisonAI's generateText() wrapper with the caller's executable tools first, receives toolResults, and only then calls onToolCall().

Because AI SDK generateText() executes tools with an execute function as part of the generation call, onToolCall can deny a tool only after the sensitive side effect has already happened. PraisonAI then returns finishReason: "tool_rejected", which is a false security signal: the rejected tool already ran.

The PoV is deterministic and local-only. It uses mock AI SDK modules, no live model call, no API key, and no network target. The tool increments an in-memory counter rather than touching the filesystem or executing commands.

Technical Details

In src/praisonai-ts/src/ai/agent-loop.ts, the public config says:

/** On tool call callback (for approval) */
onToolCall?: (toolCall: ToolCallInfo) => Promise<boolean>;

The inline approval example also asks a user for approval and returns the decision:

onToolCall: async (toolCall) => {
  const approved = await askUserForApproval(toolCall);
  return approved;
}

However, AgentLoop.step() calls generateText() with the executable tools before invoking onToolCall:

const result = await generateText({
  model: this.config.model,
  messages: this.messages as any,
  tools: this.config.tools,
  maxSteps: 1,
});

It then materializes toolResults:

toolResults: result.toolResults.map(tr => ({
  toolCallId: tr.toolCallId,
  toolName: tr.toolName,
  result: tr.result,
})),

Only afterward does the approval callback run:

if (this.config.onToolCall) {
  for (const toolCall of step.toolCalls) {
    const approved = await this.config.onToolCall(toolCall);
    if (!approved) {
      this.complete = true;
      step.finishReason = 'tool_rejected';
      break;
    }
  }
}

src/praisonai-ts/src/ai/generate-text.ts forwards the caller's tools directly to AI SDK:

const result = await sdk.generateText({
  model,
  ...
  tools: options.tools,
  maxSteps: options.maxSteps,
  ...
});

AI SDK documents that generateText() "generates text and calls tools", and that tools with an execute function run automatically unless approval is handled before execution with needsApproval.

The published npm:[email protected] dist files preserve the same order:

• dist/ai/agent-loop.js lines 150-157 call generateText() with executable tools.
• lines 162-171 materialize toolResults.
• lines 183-195 call onToolCall() and set tool_rejected afterward.

Why This Is Not Intended Behavior

This is not a trust-model-only issue. PraisonAI explicitly labels onToolCall as an approval callback and shows an approval example. A user who returns false from that callback expects the tool not to run.

It also conflicts with the AI SDK execution model PraisonAI wraps:

• AI SDK generateText() executes tools that include an execute function.
• AI SDK approval is a pre-execution boundary (needsApproval), not a post-execution notification.
• AI SDK loop control documentation treats "a tool call needs approval" as a condition that stops or pauses the loop before executing the tool.

PraisonAI's current behavior instead creates a post-execution audit hook while naming and documenting it as approval.

PoV

Run from a local reproduction checkout:

node poc/pov_poc.js 1.7.1

Expected output includes:

{
  "praisonaiVersion": "1.7.1",
  "createAgentLoopExported": true,
  "eventOrder": ["tool-executed", "approval-denied"],
  "sideEffects": 1,
  "finishReason": "tool_rejected",
  "toolCallCount": 1,
  "toolResultCount": 1,
  "rejectedAfterExecution": true,
  "vulnerable": true,
  "patchedControl": {
    "order": ["approval-denied"],
    "sideEffects": 0,
    "toolCallCount": 1,
    "toolResultCount":…

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.

Summary

The published npm package praisonai exports createAgentLoop(), whose onToolCall callback is documented and exampled as an approval hook. The implementation calls PraisonAI's generateText() wrapper with the caller's executable tools first, receives toolResults, and only then calls onToolCall().

Because AI SDK generateText() executes tools with an execute function as part of the generation call, onToolCall can deny a tool only after the sensitive side effect has already happened. PraisonAI then returns finishReason: "tool_rejected", which is a false security signal: the rejected tool already ran.

The PoV is deterministic and local-only. It uses mock AI SDK modules, no live model call, no API key, and no network target. The tool increments an in-memory counter rather than touching the filesystem or executing commands.

Technical Details

In src/praisonai-ts/src/ai/agent-loop.ts, the public config says:

/** On tool call callback (for approval) */
onToolCall?: (toolCall: ToolCallInfo) => Promise<boolean>;

The inline approval example also asks a user for approval and returns the decision:

onToolCall: async (toolCall) => {
  const approved = await askUserForApproval(toolCall);
  return approved;
}

However, AgentLoop.step() calls generateText() with the executable tools before invoking onToolCall:

const result = await generateText({
  model: this.config.model,
  messages: this.messages as any,
  tools: this.config.tools,
  maxSteps: 1,
});

It then materializes toolResults:

toolResults: result.toolResults.map(tr => ({
  toolCallId: tr.toolCallId,
  toolName: tr.toolName,
  result: tr.result,
})),

Only afterward does the approval callback run:

if (this.config.onToolCall) {
  for (const toolCall of step.toolCalls) {
    const approved = await this.config.onToolCall(toolCall);
    if (!approved) {
      this.complete = true;
      step.finishReason = 'tool_rejected';
      break;
    }
  }
}

src/praisonai-ts/src/ai/generate-text.ts forwards the caller's tools directly to AI SDK:

const result = await sdk.generateText({
  model,
  ...
  tools: options.tools,
  maxSteps: options.maxSteps,
  ...
});

AI SDK documents that generateText() "generates text and calls tools", and that tools with an execute function run automatically unless approval is handled before execution with needsApproval.

The published npm:[email protected] dist files preserve the same order:

• dist/ai/agent-loop.js lines 150-157 call generateText() with executable tools.
• lines 162-171 materialize toolResults.
• lines 183-195 call onToolCall() and set tool_rejected afterward.

Why This Is Not Intended Behavior

This is not a trust-model-only issue. PraisonAI explicitly labels onToolCall as an approval callback and shows an approval example. A user who returns false from that callback expects the tool not to run.

It also conflicts with the AI SDK execution model PraisonAI wraps:

• AI SDK generateText() executes tools that include an execute function.
• AI SDK approval is a pre-execution boundary (needsApproval), not a post-execution notification.
• AI SDK loop control documentation treats "a tool call needs approval" as a condition that stops or pauses the loop before executing the tool.

PraisonAI's current behavior instead creates a post-execution audit hook while naming and documenting it as approval.

PoV

Run from a local reproduction checkout:

node poc/pov_poc.js 1.7.1

Expected output includes:

{
  "praisonaiVersion": "1.7.1",
  "createAgentLoopExported": true,
  "eventOrder": ["tool-executed", "approval-denied"],
  "sideEffects": 1,
  "finishReason": "tool_rejected",
  "toolCallCount": 1,
  "toolResultCount": 1,
  "rejectedAfterExecution": true,
  "vulnerable": true,
  "patchedControl": {
    "order": ["approval-denied"],
    "sideEffects": 0,
    "toolCallCount": 1,
    "toolResultCount":…