An unauthenticated modification of the gateway's /api/approval/allow-list endpoint allows an attacker to add dangerous tool names such as shell_exec or file_write to the allowlist. Once those names are auto‑approved, the agent can invoke them without human review, effectively bypassing the safety controls meant to prevent malicious activity. This results in the ability to execute arbitrary code or write files, compromising confidentiality, integrity, and availability of the system.

The vulnerability applies to MervinPraison PraisonAI versions prior to 4.5.128. The affected component is the gateway service that manages the tool approval allowlist.

The CVSS score of 7.9 indicates a high severity. Exploitation is possible via unauthenticated HTTP requests to the /api/approval/allow-list endpoint; therefore the attack vector is likely network‑based web API access. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, but the high CVSS and completeness of the attack path suggest that attackers may find this asset appealing, especially in environments where the gateway is exposed.