CVE-2026-56840: PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{requestid}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are affected?
PraisonAI versions 4.5.2 through versions before 4.6.59 are affected when using praisonai.bots.HTTPApproval. Version 4.6.59 contains the patch.
What must an attacker do to exploit this issue?
The attacker needs to supply a tool argument they control so it is included in a pending approval request. A human must then open the approval URL to review that request; the injected JavaScript executes in the approval dashboard.
What is the practical impact of successful exploitation?
The injected script can send a request to the approval endpoint for the same request ID. This causes HTTPApproval to return approved=True, allowing a dangerous tool request to be approved without the reviewer intentionally approving it.