PraisonAI HTTPApproval: Cross-site scripting in approval dashboard allows approving tools
Summary
PraisonAI's HTTPApproval backend inserts pending tool arguments into the approval dashboard HTML without escaping them. An attacker who can influence a tool argument, such as a shell command, can inject JavaScript that runs when a person opens the approval page. The script can then submit an approval for that request, so a dangerous tool may run without a deliberate decision by the reviewer. Versions from 4.5.2 before 4.6.59 are affected.
Affected
- PraisonAI (pip package praisonai) from 4.5.2 before 4.6.59
- Only deployments that use the HTTP approval backend (approval_mode="http") are affected
Fixed in
- Upgrade to praisonai 4.6.59 or later
Workaround
- No official operator workaround known. Unknown.
- Restrict the approval dashboard to localhost or an internal, authenticated network until the upgrade is done
Exploitation
- Public proof of concept referenced in the vendor advisory ecosystem
- CISA SSVC: Exploitation 'poc', Automatable 'no'
- No evidence of exploitation in the wild found in the reviewed sources
- EPSS 0.00375 (low)
Our recommendation
- Identify all hosts running praisonai and check for versions 4.5.2 to 4.6.58
- Upgrade to praisonai 4.6.59 or later and confirm with pip show praisonai
- Check whether approval_mode="http" is in use and restrict the dashboard to localhost or an authenticated internal network
- Do not expose the dashboard to the internet or untrusted networks
- Review recent approvals for requests you did not initiate
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-63v4-w882-g4x2 github.com
- OSV PYSEC-2026-3503 osv.dev
- PraisonAI approval protocol documentation praison.ai
- Vulners NVD record CVE-2026-56840 vulners.com
- Strix CVE overview CVE-2026-56840 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:48.
Original description (NVD)
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.