{"id":"CVE-2026-56840","kind":"vulnerability","aliases":["CVE-2026-56840"],"related":[],"title":"PraisonAI: tool approval page runs injected JavaScript that approves requests","description":"PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.","summary":"PraisonAI's HTTPApproval dashboard (praisonai.bots.HTTPApproval) puts pending tool arguments into HTML without escaping. An attacker who controls a tool argument (for example through prompt injection) can run script in the approval page when a human opens it. The script POSTs to /approve/{request_id}/decide and approves the risky call itself, so the human-in-the-loop check is bypassed. Affects 4.5.2 up to before 4.6.59.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"praisonai","fixed":["4.6.59"],"affected":">= 4.5.2, < 4.6.59","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","human-in-the-loop","human-in-the-loop-approval","pip","praisonai","python","xss"],"not_affected_if":["console-approval","default-config","not-using-httpapproval","version-4.6.59-or-later","version-below-4.5.2"],"how_to_check":"Run 'pip show praisonai' or 'pip list | grep -i praisonai'. Versions >= 4.5.2 and < 4.6.59 are affected, but only if your code uses HTTPApproval (grep for 'HTTPApproval' or the http approval backend). Console and other approval backends are not affected.","fix":"Upgrade with 'pip install -U praisonai>=4.6.59'. Until then, use a non-HTTP approval backend, or keep the approval URL off any shared network.","status":"open","published_at":"2026-10-23T12:18:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:22+00:00","updated_at":"2026-10-23T22:31:51+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T22:31:22Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade PraisonAI to version 4.6.59 or later.","reach":"network","title":"PraisonAI: tool approval page runs injected JavaScript that approves requests","impact":"high","summary":"PraisonAI's HTTP approval dashboard inserts pending tool arguments into HTML without escaping them. An attacker who controls a tool argument can run script in the dashboard when a human reviews it, and that script can approve the risky tool call.","category":"ai-tooling","who_cares":["praisonai","python","ai-agents","human-in-the-loop"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Script runs in the approver's dashboard and auto-approves risky tool calls","analyst_note":"Confirm whether HTTPApproval is enabled in deployments and whether the approval URL is reachable beyond the operator; check the NVD entry for the attack vector.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000492,"input_tokens":3010,"output_tokens":381,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether HTTPApproval is enabled in deployments and whether the approval URL is reachable beyond the operator; check the NVD entry for the attack vector.","search":"'-2026':12A,15A '-56840':13A,16A '/approve':80B,173C '/decide':83B,176C '4.5.2':101B,116C '4.6.59':105B,120C,191C 'affect':100B 'agent':20B,111C 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'approv':3A,9A,34B,69B,85B,125C,130C,150C,182C 'argument':47B,58B,126C,138C 'attack':53B,135C 'attacker-control':134C 'bypass':99B 'call':88B 'caus':178C 'check':97B 'control':55B,136C 'cve':11A,14A 'dashboard':42B,131C,163C 'direct':127C 'endpoint':177C 'escap':51B 'exampl':60B 'html':49B,132C 'httpapprov':41B,179C 'human':25B,30B,73B,93B,147C 'human-in-the-loop':24B,92B 'human-in-the-loop-approv':29B 'id':82B,175C 'inject':6A,63B,140C 'inspect':153C 'issu':185C 'javascript':7A,141C 'loop':28B,33B,96B 'multi':110C 'multi-ag':109C 'open':74B,148C 'origin':164C 'page':4A,70B,144C 'patch':188C 'pend':45B,123C 'pip':35B 'post':78B,167C 'praisonai':1A,17A,36B,39B,106C 'praisonai.bots.httpapproval':43B,121C 'prompt':62B 'put':44B 'python':37B 'render':122C 'request':10A,81B,157C,171C,174C 'return':181C 'riski':87B,155C 'run':5A,65B,160C 'script':66B,77B,159C 'system':113C 'team':112C 'tool':2A,23B,46B,57B,124C,137C,156C 'true':183C 'url':151C 'version':115C,119C,190C 'without':50B 'xss':38B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56840","severity":null,"published_at":"2026-10-23T12:18:15+00:00","modified_at":"2026-10-23T12:18:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-56840:242","url":null,"severity":null,"published_at":"2026-10-23T22:31:51+00:00","modified_at":"2026-10-23T22:31:51+00:00","first_seen_at":"2026-10-23T22:31:51+00:00","fetched_at":"2026-10-23T22:31:51+00:00","note":"Read GHSA-63v4-w882-g4x2 (maintainer advisory) and OSV: CVSS 8.8 AV:N/UI:R, CWE-79, no exploitation reported, PoV in advisory is harmless (touch /tmp/prai010 prefix). NVD page was empty via web-cli. Did not search social. GHSA range says <=4.6.57 vs <=4.6.58 in the DB copy; fixed 4.6.59 either way."}],"documents":[{"id":1498,"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-63v4-w882-g4x2","title":"GHSA-63v4-w882-g4x2 HTTPApproval Dashboard XSS","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1499,"url":"https://osv.dev/vulnerability/GHSA-63v4-w882-g4x2","title":"OSV GHSA-63v4-w882-g4x2 (CVSS 8.8)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}