MEDIUM 6.1 GitHub
CVE-2026-60087
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments
## Summary
PraisonAI gates dangerous tools (file writes, deletes, shell/code execution) behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments.
## Root cause
`ApprovalRegistry.is_already_approved` (`src/praisonai-agents/praisonaiagents/approval/registry.py`, around line 181) returns `True` whenever the tool name is present in a per-run context set
Affected Products
- pip/praisonaiagents <= 1.6.77
References
- https://github.com/advisories/GHSA-29r9-67vg-qj56
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29r9-67vg-qj56
- https://nvd.nist.gov/vuln/detail/CVE-2026-60087
- https://nvd.nist.gov/vuln/detail/CVE-2026-62164
This medium severity vulnerability with a CVSS score of 6.1 was published on 2026-10-08 via GitHub. Affected: pip/praisonaiagents <= 1.6.77.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.