GHSA-4869-x4pr-q22x

# Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI ## Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the `/api/v1/runs` endpoint requires no credentials, and a top-level `approve` field in the submitted YAML unconditionally bypasses the `@require_approval` safety decorator on dangerous tools such as `execute_command`. **Ecosystem:** pip | **Package:** `praisonai` | **Affected:** `<= 4.6.48` | **Patched:** *(none)* --- ## Details ### Step 1 — No authentication on the Jobs API `POST /api/v1/runs` accepts and executes agent jobs from any caller with no token or session required: ```python # src/praisonai/praisonai/jobs/router.py:47 @router.post("", response_model=JobSubmitResponse, status_code=202) async def submit_job( request: Request, body: JobSubmitRequest, # accepts agent_yaml from anyone ... # missing: _: None = Depends(verify_token) ): ``` Compare with the authenticated endpoint in `api/agent_invoke.py`, which correctly includes `Depends(verify_token)`. ### Step 2 — `approve` YAML field bypasses `@require_approval` The YAML parser extracts an attacker-controlled `approve` list and loads it into a ContextVar that the approval decorator consults before every tool call: ```python # src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py:261 approve_tools = data.get('approve', []) # attacker-controlled workflow.approve_tools = approve_tools # line 370 ``` ```python # src/praisonai-agents/praisonaiagents/workflows/workflows.py:1025 if approve_tools: _approval_token = set_yaml_approved_tools(approve_tools) # adds "execute_command" to ContextVar — bypasses decorator ``` ```python # src/praisonai-agents/praisonaiagents/approval/__init__.py:179 if is_yaml_approved(tool_name): # → True mark_approved(tool_name) return func(*ar