Cloudanix VulnDB

GHSA-ffp3-3562-8cv3

Medium · 5.5

PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands

CVSS

5.5

EPSS

—

Published

Apr 10, 2026

CISA due date

—

The record

The approval system in PraisonAI Agents caches tool approval decisions by tool name only, not by invocation arguments. Once a user approves `execute_command` for any command (e.g., `ls -la`), all subsequent `execute_command` calls in that execution context bypass the approval prompt entirely. Combined with `os.environ.copy()` passing all process environment variables to subprocesses, this allows an LLM agent (potentially via prompt injection) to silently exfiltrate API keys and credentials without further user consent.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities