GHSA-29r9-67vg-qj56: Medium severity pip/praisonaiagents vulnerability

Summary

PraisonAI gates dangerous tools (file writes, deletes, shell/code execution) behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments.

Root cause

ApprovalRegistry.isalreadyapproved (src/praisonai-agents/praisonaiagents/approval/registry.py, around line 181) returns True whenever the tool name is present in a per-run context set. The cache is keyed on tool name only — arguments are not part of the key.

approvesync / approveasync (around lines 224-226 / 278-279) short-circuit on that cache before the approval backend is consulted.

clearapproved (around lines 186-187) is the only routine that clears the cache, but it is never invoked in the shipped library (only in tests). The cache persists for the entire agent run and is inherited by child tasks via contextvars.

Critical-tier tools (executecommand, executecode) are exempt from the cache. But high-risk tools like writefile are not.

Proof of concept

python from praisonaiagents.approval.registry import ApprovalRegistry from praisonaiagents.approval.protocols import ApprovalDecision, ApprovalRequest

class CountingBackend: def init(self): self.prompts = [] def requestapprovalsync(self, request): self.prompts.append((request.toolname, dict(request.arguments))) return ApprovalDecision(approved=True, reason="human approved")

backend = CountingBackend() reg = ApprovalRegistry() reg.setbackend(backend) reg.addrequirement("writefile", "high")

d1 = reg.approvesync("agent", "writefile", {"path": "/tmp/safe.txt", "content": "hi"}) Human prompted — approves a benign write

d2 = reg.approvesync("agent", "writefile", {"path": "/etc/crontab", "content": " root evil"}) NO prompt — auto-approved from cache

assert len(backend.prompts) == 1 assert d2.reason == "Already approved in context"

Negative control: executecommand (critical) re-prompts on every call — 2 prompts for 2 calls.

Impact

A writefile approval for a benign path authorizes every later writefile call in the session with arbitrary arguments. A model steered by malicious input can write to sensitive locations with no further human prompt.

Suggested fix

- Include arguments in the approval cache key, or re-prompt on argument change. - Expire the cache per-call or per-turn. - Do not inherit the cache into child tasks.