CVE-2026-56840

Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.5.2 through 4.6.57

Description The praisonai.bots.HTTPApproval component renders pending tool approval arguments directly into the dashboard HTML without proper escaping. This allows an attacker to inject JavaScript via tool arguments. When a human reviewer opens the approval page, the injected script executes in the dashboard origin and can automatically send a POST request to the /approve/{request id}/decide endpoint. This action can bypass the human-in-the-loop safety boundary, causing the system to mark dangerous tool calls as approved. The issue is rooted in the build html() function within src/praisonai/praisonai/bots/ http approval.py, which uses raw f-string interpolation for tool name, risk level, agent name, and tool argument keys and values.

Recommendations For versions 4.5.2 through 4.6.57, escape all untrusted values including tool name, risk level, agent name, and all argument keys and values using html.escape(str(value), quote=True) or a template engine with auto-escaping before inserting them into the HTML. Implement a restrictive Content Security Policy (CSP) and avoid using inline JavaScript. Require a per-request decision token that is not located within attacker-controlled rendered fields.