Unrated severityNVD Advisory· Published Jul 15, 2026· Updated Jul 15, 2026
PraisonAI before 1.6.78 Tool Approval Cache Bypass
CVE-2026-60087
Description
PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in the same session.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29r9-67vg-qj56mitrevendor-advisory
- www.vulncheck.com/advisories/praisonai-before-tool-approval-cache-bypassmitrethird-party-advisory
News mentions
0No linked articles in our index yet.