Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI

Summary

An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint requires no credentials, and a top-level approve field in the submitted YAML unconditionally bypasses the @require_approval safety decorator on dangerous tools such as execute_command.

Ecosystem: pip | Package: praisonai | Affected: <= 4.6.48 | Patched: (none)

Details

Step 1 — No authentication on the Jobs API

POST /api/v1/runs accepts and executes agent jobs from any caller with no token or session required:

# src/praisonai/praisonai/jobs/router.py:47
@router.post("", response_model=JobSubmitResponse, status_code=202)
async def submit_job(
    request: Request,
    body: JobSubmitRequest,   # accepts agent_yaml from anyone
    ...
    # missing: _: None = Depends(verify_token)
):

Compare with the authenticated endpoint in api/agent_invoke.py, which correctly includes Depends(verify_token).

Step 2 — approve YAML field bypasses @require_approval

The YAML parser extracts an attacker-controlled approve list and loads it into a ContextVar that the approval decorator consults before every tool call:

# src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py:261
approve_tools = data.get('approve', [])   # attacker-controlled
workflow.approve_tools = approve_tools    # line 370

# src/praisonai-agents/praisonaiagents/workflows/workflows.py:1025
if approve_tools:
    _approval_token = set_yaml_approved_tools(approve_tools)
    # adds "execute_command" to ContextVar — bypasses decorator

# src/praisonai-agents/praisonaiagents/approval/__init__.py:179
if is_yaml_approved(tool_name):   # → True
    mark_approved(tool_name)
    return...