Executive brief
PraisonAI, an AI agent framework, contains a flaw in how it handles human-in-the-loop security approvals for sensitive actions. When a user approves a tool like "file write" for a safe operation, the system remembers that approval for the rest of the session based only on the tool's name. This allows the AI (potentially influenced by malicious input) to perform dangerous actions, such as overwriting system files, without asking for permission again.
Technical details
The vulnerability exists in the `ApprovalRegistry.is_already_approved` method within the `praisonaiagents` package. The registry caches approvals using only the tool name as a key, failing to include the specific arguments or parameters in the cache validation. While "critical" tools like code execution are exempt, "high-risk" tools such as `write_file` are affected. An attacker can provide input that first triggers a benign tool call to gain human approval, then follow up with a malicious call (e.g., writing to `/etc/crontab`) which the system will auto-approve because the tool name is already in the session cache. This issue is resolved in version 1.6.78.
Affected products
- MervinPraison PraisonAI (praisonaiagents) < 1.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date