Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| praisonai | npm | >= 1.4.0, <= 1.7.1 | 1.7.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is a logical flaw in the AgentLoop.step function in src/praisonai-ts/src/ai/agent-loop.ts. The function is designed to use an onToolCall callback for approving or denying tool execution. However, the implementation calls the generateText function, which executes the tool, before invoking the onToolCall callback. Consequently, the approval check happens after the tool has already executed, making the security control ineffective. An attacker can trigger a tool, and even if the application logic denies the action, the tool's side effects will have already occurred. The fix would involve reordering the operations to ensure the onToolCall approval happens before the tool is executed.
if (this.config.onToolCall) {
for (const toolCall of step.toolCalls) {
const approved = await this.config.onToolCall(toolCall);
if (!approved) {
this.complete = true;
step.finishReason = 'tool_rejected';
break;
}
}
}
src/praisonai-ts/src/ai/generate-text.ts forwards the caller's tools directly to AI SDK:
const result = await sdk.generateText({
model,
...
tools: options.tools,
maxSteps: options.maxSteps,
...
});
AI SDK documents that generateText() "generates text and calls tools", and that tools with an execute function run automatically unless approval is handled before execution with needsApproval.
The published npm:praisonai@1.7.1 dist files preserve the same order:
dist/ai/agent-loop.js lines 150-157 call generateText() with executable tools.toolResults.onToolCall() and set tool_rejected afterward.This is not a trust-model-only issue. PraisonAI explicitly labels onToolCall as an approval callback and shows an approval example. A user who returns false from that callback expects the tool not to run.
It also conflicts with the AI SDK execution model PraisonAI wraps:
generateText() executes tools that include an execute function.needsApproval), not a post-execution notification.PraisonAI's current behavior instead creates a post-execution audit hook while naming and documenting it as approval.
Run from a local reproduction checkout:
node poc/pov_poc.js 1.7.1
Expected output includes:
{
"praisonaiVersion": "1.7.1",
"createAgentLoopExported": true,
"eventOrder": ["tool-executed", "approval-denied"],
"sideEffects": 1,
"finishReason": "tool_rejected",
"toolCallCount": 1,
"toolResultCount": 1,
"rejectedAfterExecution": true,
"vulnerable": true,
"patchedControl": {
"order": ["approval-denied"],
"sideEffects": 0,
"toolCallCount": 1,
"toolResultCount": 0,
"blocksBeforeExecution": true
}
}
The PoV installs npm:praisonai@1.7.1 into a temporary project and supplies mock ai and @ai-sdk/openai modules. The mocked generateText() returns one tool-call intent and executes a supplied execute handler if present. This keeps the proof deterministic and isolates PraisonAI's ordering bug.
The vulnerable run uses createAgentLoop() with:
dangerousWrite tool whose execute() handler increments an in-memory side-effect counter and records tool-executed;onToolCall approval callback that always returns false and records approval-denied.The observed order is:
tool-executed > approval-denied
That proves denial happens after execution. The toolResults array contains the tool's result even though PraisonAI reports finishReason: "tool_rejected".
The patched-control comparison strips executable handlers before the model step, requests approval on the tool-call intent, and only executes if approval succeeds. With the same denial decision, the control output is:
approval-denied
sideEffects = 0
toolResultCount = 0
The PoV section above contains the local reproduction command, input, and decisive output.
Any application using npm PraisonAI createAgentLoop() with onToolCall as a human-in-the-loop or policy approval boundary can execute denied tools.
If the application exposes the agent loop to lower-trust prompts or users and registers powerful tools, an attacker can cause the model to call a tool that the approval callback denies. The denial occurs too late. Depending on the registered tool, impact can include file modification, command execution, external API calls, data mutation, credential use, or other side effects with the privileges of the PraisonAI process.
The report does not claim that npm PraisonAI exposes this as a default network service. It is a library-level approval-boundary bypass in the exported TypeScript agent-loop API.
Suggested severity: High.
Rationale:
AV: common deployment pattern is an application exposing agent prompts over a network.AC: attacker only needs to induce a tool call.PR: conservative base score assumes the attacker can submit prompts to the application.UI: no additional operator action is needed for the tool to execute before denial; even a denial callback is too late.S: impact is in the PraisonAI-hosting application process.C/I/A: depends on registered tools; shell/file/API tools can affect confidentiality, integrity, and availability.If maintainers score only local scripts that process untrusted repositories or prompts, AV:L may be reasonable. If they score public unauthenticated prompt endpoints built on this API, PR:N may be reasonable.
Do not pass executable tool handlers into generateText() before approval.
One safe shape:
execute.generateText() to obtain the model's tool-call intent.onToolCall(toolCall) before any side effect.Alternatively, if PraisonAI wants to delegate approval to AI SDK v6, translate onToolCall into per-tool needsApproval semantics so AI SDK pauses before calling execute.
Regression tests should include:
onToolCall returns false and the tool execute() counter remains zero;onToolCall returns true and the tool executes exactly once;tool_rejected is never reported together with a tool result produced by the denied tool;MervinPraison/PraisonAInpm:praisonaiAgentLoop1ad58ca02975ff1398efeda694ea2ab78f20cf3ev4.6.581.7.1Suggested affected range:
npm:praisonai >= 1.4.0, <= 1.7.1
Selected version sweep:
1.0.0: package main cannot be required in the selected test environment.1.2.0: createAgentLoop is not exported.1.3.6: createAgentLoop is not exported.1.4.0: vulnerable.1.5.0: vulnerable.1.5.4: vulnerable.1.6.0: vulnerable.1.7.0: vulnerable.1.7.1: vulnerable.This is distinct from known and previously submitted PraisonAI issues:
GHSA-ffp3-3562-8cv3 covers Python praisonaiagents approval cache keyed by tool name rather than invocation arguments.GHSA-qwgj-rrpj-75xm covers Python Chainlit UI overriding configured approval mode with auto.GHSA-63v4-w882-g4x2 / poc covers Python HTTPApproval approval-page XSS.AgentOS missing authentication.codeMode sandbox escape.MCPServer missing authentication.No visible local or GitHub advisory covers npm TypeScript AgentLoop.onToolCall executing after tool results already exist.