PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
Date: 2026-06
Affected: pip/praisonai
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CWE: CWE-693
CWE-78
CWE-863
CVSS: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

# PraisonAI `recipe.run_stream()` skips dangerous-tool policy enforcement ## Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes `allow_dangerous_tools=True`. The normal `recipe.run()` path enforces this with `_check_tool_policy()`. The streaming path, `recipe.run_stream()`, loads the same recipe, checks dependencies, and then calls `_execute_recipe()` without running the dangerous-tool policy check. As a result, a recipe that honestly declares `execute_command` in `TEMPLATE.yaml requires.tools` is denied by `recipe.run()`, but reaches the execution engine through `recipe.run_stream()` with `allow_dangerous_tools=False`. The local PoV uses a harmless `printf` canary, explicitly unsets `PRAISONAI_AUTO_APPROVE`, and avoids network access. ## Affected Product - Repository: `MervinPraison/PraisonAI` - Package: `praisonai` - Components: - `src/praisonai/praisonai/recipe/core.py` - `src/praisonai/praisonai/recipe/serve.py` - `src/praisonai/praisonai/cli/features/recipe.py` - `src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py` - `src/praisonai-agents/praisonaiagents/workflows/workflows.py` Validated affected: - current main `2f9677abb2ea68eab864ee8b6a828fd0141612e1` (`v4.6.57-4-g2f9677ab`) - `v4.6.57` - `v4.6.56` - `v4.6.10` - `v4.6.9` - `v4.5.128` - `v4.5.120` - `v4.5.96` - `v4.5.87` Suggested affected range: `>= 4.5.87, <= 4.6.57`. PyPI lists `PraisonAI 4.6.57` as the latest release on 2026-


Mitigations:

Architectural layers (MAESTRO):