Live › vulnerability › CVE-2026-56840
Go to dashboardPraisonAI's HTTPApproval dashboard (praisonai.bots.HTTPApproval) puts pending tool arguments into HTML without escaping. An attacker who controls a tool argument (for example through prompt injection) can run script in the approval page when a human opens it. The script POSTs to /approve/{request_id}/decide and approves the risky call itself, so the human-in-the-loop check is bypassed. Affects 4.5.2 up to before 4.6.59.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| praisonai | pypi | >= 4.5.2, < 4.6.59 | 4.6.59 |
pip show praisonai or pip list | grep -i praisonai4.5.2 and < 4.6.59 are affected, but only if your code uses HTTPApproval (grep for HTTPApproval or the http approval backend)pip install -U praisonai>=4.6.59Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.
This page as .md · .json · in your agent: get_signal("CVE-2026-56840")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.