# PraisonAI tool approval cache bypass in shell command execution

Source: https://junglewise.ai/threats/praisonai-tool-approval-cache-bypass-in-shell-command-execution-2123e935  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-19  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.5 · Published 2026-06-19

PraisonAI is an AI agent framework that allows LLMs to execute tools like shell commands. A flaw in how the system remembers user approvals allows an agent to run unauthorized commands after a single benign command is approved. This could allow a malicious agent or a prompt injection attack to silently steal sensitive information like API keys and credentials from the system's environment variables.

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.5, published 19 June 2026.

**Which products and versions are affected?** PraisonAI PraisonAI < 1.5.128; PraisonAI praisonaiagents <= 4.5.124.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'require_approval' decorator in PraisonAI caches tool approval status using only the tool name as a key. Once a user approves a tool like 'execute_command' for a benign action (e.g., 'ls'), the system marks that tool name as approved for the entire execution context. Subsequent calls to the same tool with different, potentially malicious arguments (e.g., 'env' or 'printenv') bypass the approval prompt entirely. This is exacerbated by the framework passing the full process environment to subprocesses via 'os.environ.copy()', enabling secret exfiltration. The issue is fixed in version 1.5.128.

## Affected products

- PraisonAI PraisonAI < 1.5.128
- PraisonAI praisonaiagents <= 4.5.124

## Timeline

- 2026-04-09: advisory: Original GHSA-ffp3-3562-8cv3 published
- 2026-06-18: disclosed: NVD/VulnCheck publication of CVE-2026-56074
- 2026-06-19: other: Duplicate advisory GHSA-x44p-gg67-52fc published and withdrawn

## References

- [https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ffp3-3562-8cv3](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ffp3-3562-8cv3)
- [https://www.vulncheck.com/advisories/praisonai-tool-approval-cache-bypass-via-coarse-grained-caching](https://www.vulncheck.com/advisories/praisonai-tool-approval-cache-bypass-via-coarse-grained-caching)