PraisonAI's jobs API took any caller's YAML and let it pre-approve its own commands

What happened

The unauthenticated POST /api/v1/runs endpoint accepts attacker-controlled agent_yaml, and an approve field in that YAML marks execute_command as pre-approved, turning the require_approval decorator into a no-op. The chain gives full remote command execution with no credentials and no operator interaction, scored CVSS 3.1 9.8. Patched in praisonai 4.6.59 and praisonaiagents 1.6.59.

One of at least eight PraisonAI CVE records published on 14 September. The verified companions include an IMAP command injection through LLM-controlled email fields scored 8.1 and an authentication bypass through the PRAISONAI_CALL_AUTH environment variable scored 8.2, fixed in 4.6.62.