CVE-2026-56840High· 8.8▾ TwilightPraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.
PraisonAI >= 4.5.2, < 4.6.59Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
praisonai >= 4.5.2, < 4.6.59Patched in:
praisonai 4.6.59Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57122High· 8.6PraisonAI is a multi-agent teams system
CVE-2026-57117High· 8.8PraisonAI: Compute-bridged file tools allow shell command injection
CVE-2026-57126High· 8.5PraisonAI is a multi-agent teams system
CVE-2026-57112High· 8.3PraisonAI is a multi-agent teams system
CVE-2026-56838High· 7.8PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
CVE-2026-57114High· 7.2PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding