GHSA-v847-hxxw-3pxg: PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI recipe.run_stream() skips dangerous-tool policy enforcement Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. The local PoV uses a harmless printf canary, explicitly unsets PRAISONAI_AUTO_APPROVE, and avoids network access. Affected Product - Repository: MervinPraison/PraisonAI - Package: praisonai - Components: - src/praisonai/praisonai/recipe/core.py - src/praisonai/praisonai/recipe/serve.py - src/praisonai/praisonai/cli/features/recipe.py - src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py - src/praisonai-agents/praisonaiagents/workflows/workflows.py Validated affected: - current main 2f9677abb2ea68eab864ee8b6a828fd0141612e1 (v4.6.57-4-g2f9677ab) - v4.6.57 - v4.6.56 - v4.6.10 - v4.6.9 - v4.5.128 - v4.5.120 - v4.5.96 - v4.5.87 Suggested affected range: >= 4.5.87, <= 4.6.57. PyPI lists PraisonAI 4.6.57 as the latest release on 2026-06-13. Earlier tested tags through v4.5.85 failed in this source checkout before the tested workflow path due an unrelated praisonaiagents.output.models import error. They are not claimed fixed or unaffected. Root Cause recipe.run() enforces the dangerous-tool gate: if not options.get("allow_dangerous_tools", False): policy_error = _check_tool_policy(recipe_config) if policy_error: return RecipeResult(..., status=RecipeStatus.POLICY_DENIED, ...) recipe.run_stream() has a sibling execution path. It loads the recipe and checks dependencies, but then goes directly to executio