https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-08T22:45:41.700473+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-55530 CVE-2026-55530 — PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutat… 2026-10-08T22:45:41.701731+00:00

Affected: MervinPraison PraisonAI, MervinPraison praisonaiagents

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval decorator used by sibling mutation tools. With dry_run=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected authorization gate. This issue is fixed in version 1.6.58.

 https://db.gcve.eu/vuln/pysec-2026-3901 PYSEC-2026-3901 — praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling… 2026-10-08T22:45:41.701806+00:00

Affected: PyPI: praisonaiagents

**Target:** PraisonAI (`MervinPraison/PraisonAI`) **Affected component:** `praisonaiagents/tools/ast_grep_tool.py` — `ast_grep_rewrite` **Affected versions:** master at `ce97667156a116c50b4a3d1aa21e09f048903fda`; reproduced against the current `praisonaiagents` PyPI release (`praisonaiagents` <= 1.6.52).

## Summary

Tools in `praisonaiagents/tools/` that modify on-disk state or run code are uniformly wrapped with `@require_approval`, which routes the call through an interactive approval flow before the body runs and fails closed — on denial (or with no approval backend configured) it raises `PermissionError` and the side effect does not occur. This is applied at every sibling mutation entry point:

| File | Line | Symbol | Risk level | |---|---|---|---| | `file_tools.py` | 212 | `copy_file` | high | | `file_tools.py` | 239 | `move_file` | high | | `file_tools.py` | 266 | `delete_file` | high | | `edit_tools.py` | 38 | `EditTools.edit_file` | high | | `edit_tools.py` | 155 | `edit_file` | high | | `shell_tools.py` | 32 | `execute_command` | critical | | `python_tools.py` | 352 | `execute_code` | critical |

`ast_grep_tool.py:149` `ast_grep_rewrite` is structurally a sibling of these but has no decorator and no `from ..approval import require_approval` import. With `dry_run=False` (LLM-controllable), it builds `sg --pattern <P> --rewrite <R> --lang <L> --update-all <path>` (lines 204–211) and calls `subprocess.run(cmd, ...)` (line 215), modifying every file under `path` match…