---
id: "CVE-2026-56840"
kind: "vulnerability"
aliases: ["CVE-2026-56840"]
title: "PraisonAI: tool approval page runs injected JavaScript that approves requests"
severity: "high"
cvss: 8.8
epss: 0.0045
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "praisonai", "fixed": ["4.6.59"], "affected": ">= 4.5.2, < 4.6.59", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-agents", "ai-tooling", "human-in-the-loop", "human-in-the-loop-approval", "pip", "praisonai", "python", "xss"]
not_affected_if: ["console-approval", "default-config", "not-using-httpapproval", "version-4.6.59-or-later", "version-below-4.5.2"]
published_at: "2026-10-23T12:18:15+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56840", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:31:51+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-56840", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# PraisonAI: tool approval page runs injected JavaScript that approves requests

PraisonAI's HTTPApproval dashboard (praisonai.bots.HTTPApproval) puts pending tool arguments into HTML without escaping. An attacker who controls a tool argument (for example through prompt injection) can run script in the approval page when a human opens it. The script POSTs to /approve/{request_id}/decide and approves the risky call itself, so the human-in-the-loop check is bypassed. Affects 4.5.2 up to before 4.6.59.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:praisonai affected >= 4.5.2, < 4.6.59 fixed 4.6.59

## How to check

Run 'pip show praisonai' or 'pip list | grep -i praisonai'. Versions >= 4.5.2 and < 4.6.59 are affected, but only if your code uses HTTPApproval (grep for 'HTTPApproval' or the http approval backend). Console and other approval backends are not affected.

## Fix

Upgrade with 'pip install -U praisonai>=4.6.59'. Until then, use a non-HTTP approval backend, or keep the approval URL off any shared network.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56840
- 2026-10-23T22:31:51+00:00 analyst — Read GHSA-63v4-w882-g4x2 (maintainer advisory) and OSV: CVSS 8.8 AV:N/UI:R, CWE-79, no exploitation reported, PoV in advisory is harmless (touch /tmp/prai010 prefix). NVD page was empty via web-cli. Did not search social. GHSA range says <=4.6.57 vs <=4.6.58 in the DB copy; fixed 4.6.59 either way.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-56840

## Documents

- [advisory] GHSA-63v4-w882-g4x2 HTTPApproval Dashboard XSS https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-63v4-w882-g4x2
- [describes] OSV GHSA-63v4-w882-g4x2 (CVSS 8.8) https://osv.dev/vulnerability/GHSA-63v4-w882-g4x2

## From the sources

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_