GHSA-cfxv-8fw8-rwpv: praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

Summary

The `ast_grep_rewrite` function in `praisonaiagents/tools/ast_grep_tool.py` lacks the `@require_approval` decorator that every sibling file-mutation and code-execution tool in `praisonaiagents/tools/` applies. With `dry_run=False`, an LLM-controllable call runs `sg ... --update-all` through `subprocess.run`, rewriting every file under `path` that matches the pattern, with no approval gate, no `_validate_path` workspace check, and no `cwd=` sandboxing. The function returns the string `No changes made` even when files were modified.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database