PraisonAI’s recipe.run_stream function bypasses the dangerous‑tool enforcement that the normal recipe.run() path implements. This missing check allows a recipe to declare execution of dangerous tools such as execute_command and then actually run them with the default denial of dangerous tools policy disabled. The result is that an attacker who can supply or influence recipes can execute arbitrary commands, compromising the confidentiality, integrity, and availability of the system. The flaw involves improper authentication or authorization (CWE‑693), unsafe function execution (CWE‑78), and privilege escalation or unauthorized access (CWE‑863).

MervinPraison PraisonAI versions 4.5.87 through 4.6.58 are affected. The issue was patched in version 4.6.59, which restores the policy check in the streaming path.

The CVSS score of 7.8 classifies the vulnerability as high severity, and while EPSS data is not available, the fault is not listed in the CISA KEV catalog. The likely attack vector is local or privileged access to the system where an attacker can feed a malicious recipe to the run_stream endpoint. Successful exploitation would give the attacker the ability to run arbitrary system commands through the recipe execution engine.