CVE-2026-56840: PraisonAI: stored XSS in approval dashboard forces tool approval

HIGH

Published October 23, 2026

CISO Take

PraisonAI's HTTPApproval dashboard renders pending tool-call arguments as raw HTML, so an attacker-controlled argument can inject JavaScript that runs when a human opens the approval page to review a risky request. That script can silently POST to the same request's decide endpoint and return approved=True, which defeats the human-in-the-loop control that is meant to gate dangerous agent actions. The CVSS is 8.8 with no privileges required and low complexity, but user interaction is required. No public exploit, Nuclei template or KEV listing exists and EPSS is not yet available, and the package has only 1 downstream dependent, so broad exposure looks limited. The package does have 187 other CVEs, which points to a weak security track record. Upgrade PraisonAI to 4.6.59 or later, and until then do not rely on HTTPApproval as a security boundary for high-impact tools.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High severity (CVSS 8.8). Exploitation is network-based, low complexity, needs no privileges and needs one reviewer click on the approval URL. The main risk is bypass of the human approval control, which turns a gated tool request into an approved one. Likelihood is moderate: there is no known public exploit and no KEV listing, and EPSS is unavailable. Exposure is limited to deployments that use praisonai.bots.HTTPApproval between versions 4.5.2 and 4.6.58, and only when an attacker can influence tool arguments, for example through prompt injection or untrusted input. Confidence: MEDIUM, because it is based on the advisory text and there is no exploitation data.

How does the attack unfold?

Payload Injection

The attacker gets a tool argument containing JavaScript into an agent's pending tool request, for example through prompt injection or untrusted input.

AML.T0051

Reviewer Lure

The agent raises an approval request and a human reviewer opens the approval URL to inspect the risky tool call.

AML.T0011.003

Script Execution

The dashboard renders the argument unescaped, and the script runs in the dashboard origin and POSTs approved=True to /approve/{request_id}/decide.

Unauthorized Tool Execution

The agent runs the tool without a genuine human decision, which can result in data theft, code execution or other harmful actions.

AML.T0053

Payload Injection

The attacker gets a tool argument containing JavaScript into an agent's pending tool request, for example through prompt injection or untrusted input.

AML.T0051

Reviewer Lure

The agent raises an approval request and a human reviewer opens the approval URL to inspect the risky tool call.

AML.T0011.003

Script Execution

The dashboard renders the argument unescaped, and the script runs in the dashboard origin and POSTs approved=True to /approve/{request_id}/decide.

Unauthorized Tool Execution

The agent runs the tool without a genuine human decision, which can result in data theft, code execution or other harmful actions.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade PraisonAI to 4.6.59 or later. 2) Until patched, disable HTTPApproval for high-risk tools or move approvals to a channel that does not render arguments as HTML. 3) Serve the approval dashboard from an isolated origin and restrict access to it by network or VPN. 4) Add a strict Content-Security-Policy that blocks inline scripts on the dashboard. 5) Reduce agent tool privileges, with sandboxing and least-privilege credentials. 6) Detection: review approval logs for requests approved with unusually short latency, and for tool arguments containing HTML or script tags such as <script>, onerror= or javascript:. 7) Audit past approvals made since 4.5.2 for unexpected tool executions.

How is it classified?

Auth BypassPrompt InjectionCode ExecutionAgentFrameworkPluginAML.T0011.003- Malicious Link AML.T0051- LLM Prompt Injection AML.T0053- AI Agent Tool Invocation AML.T0093- Prompt Infiltration via Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 14-Human oversight

ISO 42001

A.9.2-Processes for responsible use of AI systems

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-56840?

Is CVE-2026-56840 actively exploited?

No confirmed active exploitation of CVE-2026-56840 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56840?

1) Upgrade PraisonAI to 4.6.59 or later. 2) Until patched, disable HTTPApproval for high-risk tools or move approvals to a channel that does not render arguments as HTML. 3) Serve the approval dashboard from an isolated origin and restrict access to it by network or VPN. 4) Add a strict Content-Security-Policy that blocks inline scripts on the dashboard. 5) Reduce agent tool privileges, with sandboxing and least-privilege credentials. 6) Detection: review approval logs for requests approved with unusually short latency, and for tool arguments containing HTML or script tags such as <script>, onerror= or javascript:. 7) Audit past approvals made since 4.5.2 for unexpected tool executions.

What systems are affected by CVE-2026-56840?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, human-in-the-loop approval workflows, multi-agent systems, tool-calling agents.

What is the CVSS score for CVE-2026-56840?

CVE-2026-56840 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

agent frameworkshuman-in-the-loop approval workflowsmulti-agent systemstool-calling agents

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0051LLM Prompt Injection

AML.T0053AI Agent Tool Invocation

AML.T0093Prompt Infiltration via Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 14

ISO 42001: A.9.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's /approve/{request_id}/decide endpoint, causing HTTPApproval to return approved=True. This issue has been patched in version 4.6.59.

Exploitation Scenario

An attacker supplies content, for example a poisoned document or web page or a crafted user message, that makes a PraisonAI agent request a tool call. The call's arguments contain an HTML/JavaScript payload. The agent pauses and raises an approval request, and a security reviewer opens the approval URL to inspect it. The dashboard renders the argument unescaped, the script executes in the dashboard origin and POSTs to /approve/{request_id}/decide to set approved=True. The agent then runs the risky tool, for example exfiltrating data or running commands, before the reviewer decides anything.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Primary CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.