Cloudanix VulnDB

GHSA-qwgj-rrpj-75xm

High · 8.8

PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution

CVSS

8.8

EPSS

—

Published

Apr 10, 2026

CISA due date

—

The record

The Chainlit UI modules (`chat.py` and `code.py`) hardcode `config.approval_mode = "auto"` after loading administrator configuration from the `PRAISON_APPROVAL_MODE` environment variable, silently overriding any "manual" or "scoped" approval setting. This defeats the human-in-the-loop approval gate for all ACP tool executions, including shell command execution via `subprocess.run(..., shell=True)`. An authenticated user can instruct the LLM agent to execute arbitrary single-command shell operations on the server without any approval prompt.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities