{"items":[{"id":"NVI-00016052","kind":"vulnerability","title":"PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-63v4-w882-g4x2","CVE-2026-56840"],"plain_summary":"GitHub lists this reviewed advisory for praisonai. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-100b8dbf84d5e1deebdebcd68faa9b4b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:23:51.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-100b8dbf84d5e1deebdebcd68faa9b4b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-100b8dbf84d5e1deebdebcd68faa9b4b","url":"https://github.com/advisories/GHSA-63v4-w882-g4x2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-63v4-w882-g4x2","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:47:44.783Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-100b8dbf84d5e1deebdebcd68faa9b4b"],"technology":"praisonai","known_exclusions":[],"conditions_summary":"# HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools\n\n## Summary\n\n`praisonai.bots.HTTPApproval` renders pending tool approval arguments directly\ninto the approval dashboard HTML. An attacker-controlled tool argument can\ninject JavaScript into that page. When a human opens the approval URL to inspect\nthe risky tool request, the script runs in the dashboard origin and can POST to\nthe same request's `/approve/{request_id}/decide` endpoint, causing\n`HTTPApproval` to return `approved=True`.\n\nThe local PoV uses a harmless `touch /tmp/prai010 #` command prefix and stops at\nthe approval decision. It does not execute the command.\n\n## Affected Versions\n\nProposed affected range: `>= 4.5.2, <= 4.6.57`.\n\nValidated affected:\n\n- current head `2f9677abb2ea68eab864ee8b6a828fd0141612e1`\n  (`v4.6.57-4-g2f9677ab`)\n- `v4.5.2`\n- `v4.5.3`\n- `v4.5.124`\n- `v4.5.126`\n- `v4.5.128`\n- `v4.6.10`\n- `v4.6.56`\n- `v4.6.57`\n\n`v4.5.0` and `v4.5.1` do not contain the HTTPApproval backend.\n\n## Impact\n\nAn attacker who can influence an agent task or prompt enough to produce a\ndangerous tool call can embed a short XSS payload in the tool argument. When the\nhuma","public_affected_ranges":[">= 4.5.2, <= 4.6.58"]}],"null_published_at":"2026-11-04T10:04:27.870Z","source_updated_at":"2026-07-20T21:23:51.000Z","source_disclosed_at":"2026-06-18T13:52:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T02:47:44.783Z"}],"next_cursor":null,"snapshot_revision":"42594"}