EUVD-2026-37958
GHSA-x44p-gg67-52fc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector (agent runs on victim machine), no privileges required but mandatory initial user interaction (UI:R); high confidentiality via full env var exfiltration, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command calls to bypass approval prompts. Attackers can exploit this by obtaining initial approval for a benign command, then silently exfiltrate API keys and credentials via subsequent shell commands without user consent.
AnalysisAI
Tool approval cache bypass in PraisonAI Agents (praisonaiagents < 4.5.128) allows an LLM agent to execute arbitrary subsequent shell commands without user consent after a single initial approval. The approval system caches decisions keyed only on tool name - once a user approves execute_command for any command (e.g., ls -la), all further execute_command invocations in that agent session bypass the approval prompt entirely. Combined with os.environ.copy() passing the full process environment to every subprocess, this enables silent exfiltration of API keys and credentials; a publicly available proof-of-concept is included in the GHSA advisory. No confirmed active exploitation in CISA KEV at time of analysis.
Technical ContextAI
PraisonAI Agents (CPE: cpe:2.3:a:praisonai:praisonai:*:*:*:*:*:*:*:*) implements a human-in-the-loop tool approval mechanism via a require_approval decorator in src/praisonai-agents/praisonaiagents/approval/__init__.py. The root cause (CWE-863: Incorrect Authorization) is that is_already_approved() at line 177 checks approval state by tool name string alone, not by the specific invocation arguments. The mark_approved() function in registry.py:144-147 stores only the string 'execute_command', not the command being approved. The clear_approved() function exists at registry.py:152 but is never invoked during the agent's tool execution path (agent/tool_execution.py), so approval state persists for the entire session. The ConsoleBackend UI at backends.py:81-96 displays specific command arguments and asks for confirmation in a way that implies per-invocation consent ('Do you want to execute this ... risk tool?'), creating a misleading security expectation. Separately, shell_tools.py:77 passes os.environ.copy() - including all process-level secrets like OPENAI_API_KEY - to every subprocess without any environment variable sanitization or command filtering.
RemediationAI
Upgrade the praisonaiagents pip package to version 4.5.128 or later, where the approval cache is expected to key on both tool name and invocation arguments. The vendor advisory is at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ffp3-3562-8cv3 and the VulnCheck write-up at https://www.vulncheck.com/advisories/praisonai-tool-approval-cache-bypass-via-coarse-grained-caching. As a compensating control prior to patching, remove execute_command and all shell tools from agent configurations where possible - this eliminates the attack surface entirely at the cost of losing shell automation capability. Alternatively, strip sensitive environment variables (e.g., OPENAI_API_KEY, AWS_SECRET_ACCESS_KEY) from the process environment before launching any PraisonAI agent session; however, this may break agent functionality that depends on those keys. Do not rely on the current approval UI as a security boundary - it is bypassable after a single user interaction.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today