CVE-2026-62164

Name of the Vulnerable Software and Affected Versions PraisonAI (affected versions not specified)

Description Dangerous tools such as file writes and deletes are protected by an interactive approval prompt. However, the first approval of a tool is cached for the duration of the run and reused for subsequent invocations of that tool, regardless of the arguments used. This occurs because the ApprovalRegistry.is already approved() function checks only the tool name in the cache, ignoring the arguments. Consequently, the approve sync() and approve async() functions bypass the approval backend if the tool name is already cached. While critical tools like execute command() and execute code() are exempt, high-risk tools such as write file are affected. This allows a model steered by malicious input to perform unauthorized writes to sensitive locations after a single benign approval. The cache is managed via contextvars and is inherited by child tasks, while the clear approved() function is not invoked in the shipped library.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the write file tool to minimize the risk of unauthorized file modifications.