PYSEC-2026-3520 — PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

Affected: PyPI: praisonai

# PraisonAI `recipe.run_stream()` skips dangerous-tool policy enforcement

## Summary

PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes `allow_dangerous_tools=True`. The normal `recipe.run()` path enforces this with `_check_tool_policy()`. The streaming path, `recipe.run_stream()`, loads the same recipe, checks dependencies, and then calls `_execute_recipe()` without running the dangerous-tool policy check.

As a result, a recipe that honestly declares `execute_command` in `TEMPLATE.yaml requires.tools` is denied by `recipe.run()`, but reaches the execution engine through `recipe.run_stream()` with `allow_dangerous_tools=False`.

The local PoV uses a harmless `printf` canary, explicitly unsets `PRAISONAI_AUTO_APPROVE`, and avoids network access.

## Affected Product

- Repository: `MervinPraison/PraisonAI` - Package: `praisonai` - Components: - `src/praisonai/praisonai/recipe/core.py` - `src/praisonai/praisonai/recipe/serve.py` - `src/praisonai/praisonai/cli/features/recipe.py` - `src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py` - `src/praisonai-agents/praisonaiagents/workflows/workflows.py`

Validated affected:

- current main `2f9677abb2ea68eab864ee8b6a828fd0141612e1` (`v4.6.57-4-g2f9677ab`) - `v4.6.57` - `v4.6.56` - `v4.6.10` - `v4.6.9` - `v4.5.128` - `v4.5.120` - `v4.5.96` - `v4.5.87`

Suggested affected range: `>= 4.5.87, <= 4.6.57`.

PyPI lists `PraisonAI 4.6.57` as the latest release on 2026…

Most recent entries from all

PYSEC-2026-3520 — PraisonAI recipe.run_stream skips dangerous-tool policy enforcement