PT-2026-61765 · Praisonai · Praisonai
CVE-2026-56840
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PraisonAI versions 4.5.2 through 4.6.57
Description
The
praisonai.bots.HTTPApproval component renders pending tool approval arguments directly into the dashboard HTML without proper escaping. This allows an attacker to inject JavaScript via tool arguments. When a human reviewer opens the approval page, the injected script executes in the dashboard origin and can automatically send a POST request to the /approve/{request id}/decide endpoint. This action can bypass the human-in-the-loop safety boundary, causing the system to mark dangerous tool calls as approved. The issue is rooted in the build html() function within src/praisonai/praisonai/bots/ http approval.py, which uses raw f-string interpolation for tool name, risk level, agent name, and tool argument keys and values.Recommendations
For versions 4.5.2 through 4.6.57, escape all untrusted values including
tool name, risk level, agent name, and all argument keys and values using html.escape(str(value), quote=True) or a template engine with auto-escaping before inserting them into the HTML.
Implement a restrictive Content Security Policy (CSP) and avoid using inline JavaScript.
Require a per-request decision token that is not located within attacker-controlled rendered fields.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Praisonai