---
id: CVE-2026-60087
aliases:
  - GHSA-29r9-67vg-qj56
title: >-
  PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently
  reused for all subsequent calls with arbitrary arguments
summary: >-
  PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently
  reused for all subsequent calls with arbitrary arguments
severity: medium
cvss: 6.1
cwe:
  - CWE-863
vendor: praisonaiagents
product: praisonaiagents
ecosystem: pip
affected:
  - praisonaiagents <= 1.6.77
patched:
  - praisonaiagents 1.6.78
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:43:46Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-29r9-67vg-qj56'
references:
  - url: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29r9-67vg-qj56
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-60087'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62164'
  - url: >-
      https://www.vulncheck.com/advisories/praisonai-before-tool-approval-cache-bypass
  - url: 'https://github.com/advisories/GHSA-29r9-67vg-qj56'
tags:
  - ghsa
  - pip
epss: 0.00148
epssPercentile: 0.03502
ingestedAt: '2026-10-08T16:52:14.780Z'
---

## Overview

## Summary

PraisonAI gates dangerous tools (file writes, deletes, shell/code execution) behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments.

## Root cause

`ApprovalRegistry.is_already_approved` (`src/praisonai-agents/praisonaiagents/approval/registry.py`, around line 181) returns `True` whenever the tool name is present in a per-run context set. The cache is keyed on tool name only — arguments are not part of the key.

`approve_sync` / `approve_async` (around lines 224-226 / 278-279) short-circuit on that cache before the approval backend is consulted.

`clear_approved` (around lines 186-187) is the only routine that clears the cache, but it is never invoked in the shipped library (only in tests). The cache persists for the entire agent run and is inherited by child tasks via `contextvars`.

Critical-tier tools (`execute_command`, `execute_code`) are exempt from the cache. But high-risk tools like `write_file` are not.

## Proof of concept

```python
from praisonaiagents.approval.registry import ApprovalRegistry
from praisonaiagents.approval.protocols import ApprovalDecision, ApprovalRequest

class CountingBackend:
    def __init__(self): self.prompts = []
    def request_approval_sync(self, request):
        self.prompts.append((request.tool_name, dict(request.arguments)))
        return ApprovalDecision(approved=True, reason="human approved")

backend = CountingBackend()
reg = ApprovalRegistry()
reg.set_backend(backend)
reg.add_requirement("write_file", "high")

d1 = reg.approve_sync("agent", "write_file", {"path": "/tmp/safe.txt", "content": "hi"})
# Human prompted — approves a benign write

d2 = reg.approve_sync("agent", "write_file", {"path": "/etc/crontab", "content": "* * * * * root evil"})
# NO prompt — auto-approved from cache

assert len(backend.prompts) == 1
assert d2.reason == "Already approved in context"
```

Negative control: `execute_command` (critical) re-prompts on every call — 2 prompts for 2 calls.

## Impact

A `write_file` approval for a benign path authorizes every later `write_file` call in the session with arbitrary arguments. A model steered by malicious input can write to sensitive locations with no further human prompt.

## Suggested fix

- Include arguments in the approval cache key, or re-prompt on argument change.
- Expire the cache per-call or per-turn.
- Do not inherit the cache into child tasks.

## Affected packages

- `praisonaiagents <= 1.6.77`

## Remediation

Upgrade to a patched release:

- `praisonaiagents 1.6.78`