CVE-2026-56840 Details

A cross-site scripting vulnerability has been identified in PraisonAI versions 4.5.2 prior to 4.6.59. The issue arises in the HTTPApproval bot, which renders pending tool approval arguments directly into the approval dashboard HTML without proper sanitization. This flaw allows an attacker to inject JavaScript into the page via a controlled tool argument. When a human approver opens the approval URL to review the tool request, the injected script executes in the dashboard's origin. It can then POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to falsely indicate that the tool has been approved. This vulnerability bypasses the intended human approval process for risky tools, such as 'execute_command' or 'delete_file', potentially leading to unauthorized actions being performed by the PraisonAI agent.

Users are advised to update to PraisonAI version 4.6.59 or later. Additionally, untrusted values should be escaped before being inserted into the approval HTML to prevent injection attacks. Consider adding a restrictive Content Security Policy and avoiding inline JavaScript.