PT-2026-60134 · Mervinpraison · Praisonai

Snailsploit · Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-60087

Mitre

CVSS v3.1

6.1

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in the same session.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-60087

Produtos afetados

Praisonai

Referências · 3

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29r9-67vg-qj56 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-60087 · Nota de Segurança
• https://vulncheck.com/advisories/praisonai-before-tool-approval-cache-bypass · Nota