{"items":[{"id":"NVI-00016032","kind":"vulnerability","title":"npm PraisonAI AgentLoop onToolCall approval runs after tool execution","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-h2w2-v7j6-xqm4","CVE-2026-57137"],"plain_summary":"GitHub lists this reviewed advisory for praisonai. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0a3529e04326004c3fa2b3fa19eee9de"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:27:16.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0a3529e04326004c3fa2b3fa19eee9de"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0a3529e04326004c3fa2b3fa19eee9de","url":"https://github.com/advisories/GHSA-h2w2-v7j6-xqm4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-h2w2-v7j6-xqm4","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:35:18.117Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0a3529e04326004c3fa2b3fa19eee9de"],"technology":"praisonai","known_exclusions":[],"conditions_summary":"## Summary\n\nThe published npm package `praisonai` exports `createAgentLoop()`, whose `onToolCall` callback is documented and exampled as an approval hook. The implementation calls PraisonAI's `generateText()` wrapper with the caller's executable tools first, receives `toolResults`, and only then calls `onToolCall()`.\n\nBecause AI SDK `generateText()` executes tools with an `execute` function as part of the generation call, `onToolCall` can deny a tool only after the sensitive side effect has already happened. PraisonAI then returns `finishReason: \"tool_rejected\"`, which is a false security signal: the rejected tool already ran.\n\nThe PoV is deterministic and local-only. It uses mock AI SDK modules, no live model call, no API key, and no network target. The tool increments an in-memory counter rather than touching the filesystem or executing commands.\n\n## Technical Details\n\nIn `src/praisonai-ts/src/ai/agent-loop.ts`, the public config says:\n\n```ts\n/** On tool call callback (for approval) */\nonToolCall?: (toolCall: ToolCallInfo) => Promise;\n```\n\nThe inline approval example also asks a user for approval and returns the decision:\n\n```ts\nonToolCall: async (toolCall) => {\n  const ","public_affected_ranges":[">= 1.4.0, <= 1.7.1"]}],"null_published_at":"2026-11-04T10:04:27.867Z","source_updated_at":"2026-07-20T21:27:16.000Z","source_disclosed_at":"2026-06-18T14:26:51.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T22:35:18.117Z"}],"next_cursor":null,"snapshot_revision":"42594"}