Executive brief
PraisonAI, an AI agent framework, contains a flaw in how it handles approvals for high-risk actions via Discord. The system incorrectly treats any message containing 'yes' or 'approve' in a designated channel as a valid authorization, even if the message is unrelated to the specific request or sent by an unauthorized user. This could allow anyone with access to the Discord channel to trigger dangerous operations like file deletions or system command execution.
Technical details
The `DiscordApproval` component in PraisonAI fails to properly bind approval responses to specific tool execution requests. When a dangerous tool call is pending, the `_poll_for_response` method retrieves the 10 most recent messages in the configured Discord channel following the approval prompt. It classifies any non-bot message containing keywords like 'yes' or 'approve' as a valid authorization without verifying if the message is a direct reply, part of a specific thread, or sent by an authorized user. This lack of request-binding and identity verification allows any user with write access to the channel to authorize privileged operations. The vulnerability was addressed in version 4.6.59.
Affected products
- MervinPraison praisonai >= 4.5.2, <= 4.6.58
Timeline
- 2026-06-17: disclosed
- 2026-06-18: advisory
- 2026-06-18: patched: Fixed in version 4.6.59