CVE-2026-60087

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.78

Description PraisonAI caches tool approval decisions using only the tool name, which allows the reuse of an initial approval for subsequent calls with arbitrary arguments. An attacker can obtain approval for a benign operation and then execute dangerous operations, such as file writes, with unreviewed parameters within the same session. This occurs because the ApprovalRegistry.is already approved() function returns True if the tool name exists in the per-run context set, regardless of the arguments used. The approve sync() and approve async() functions short-circuit based on this cache before consulting the approval backend. While critical-tier tools like execute command() and execute code() are exempt, high-risk tools such as write file() are affected.

Recommendations Update PraisonAI to version 1.6.78 or later. As a temporary mitigation, restrict the use of the write file() tool until the update is applied.