PYSEC-2026-3503: PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{requestid}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are affected?
PraisonAI versions 4.5.2 through versions before 4.6.59 are affected when using the praisonai.bots.HTTPApproval dashboard. Version 4.6.59 contains the fix.
What must an attacker do to exploit this issue?
The attacker needs to cause a pending tool-approval request to contain an attacker-controlled tool argument. A human must then open the approval URL to review that request, which triggers the injected JavaScript in the dashboard.
What is the practical impact of successful exploitation?
The injected script can send a request to the pending request's approval decision endpoint from the dashboard origin. This can cause the dangerous tool request to be marked approved without the reviewer intentionally approving it.