EUVD-2026-368479

fkie_cve-2026-57137

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.

GHSA-h2w2-v7j6-xqm4 — npm PraisonAI AgentLoop onToolCall approval runs after tool execution

Affected: npm: praisonai

## Summary

The published npm package `praisonai` exports `createAgentLoop()`, whose `onToolCall` callback is documented and exampled as an approval hook. The implementation calls PraisonAI's `generateText()` wrapper with the caller's executable tools first, receives `toolResults`, and only then calls `onToolCall()`.

Because AI SDK `generateText()` executes tools with an `execute` function as part of the generation call, `onToolCall` can deny a tool only after the sensitive side effect has already happened. PraisonAI then returns `finishReason: "tool_rejected"`, which is a false security signal: the rejected tool already ran.

The PoV is deterministic and local-only. It uses mock AI SDK modules, no live model call, no API key, and no network target. The tool increments an in-memory counter rather than touching the filesystem or executing commands.

## Technical Details

In `src/praisonai-ts/src/ai/agent-loop.ts`, the public config says:

```ts /** On tool call callback (for approval) */ onToolCall?: (toolCall: ToolCallInfo) => Promise<boolean>; ```

The inline approval example also asks a user for approval and returns the decision:

```ts onToolCall: async (toolCall) => { const approved = await askUserForApproval(toolCall); return approved; } ```

However, `AgentLoop.step()` calls `generateText()` with the executable tools before invoking `onToolCall`:

```ts const result = await generateText({ model: this.config.model, messages: this.messages as any, tools: this.…

Most recent entries from all

EUVD-2026-368479

fkie_cve-2026-57137

GHSA-h2w2-v7j6-xqm4 — npm PraisonAI AgentLoop onToolCall approval runs after tool execution