PraisonAI versions prior to 1.5.128 cache tool‑approval decisions solely by tool name, ignoring the arguments used when the tool is invoked. This flaw allows an attacker who has received an initial, benign approval for a tool to subsequently execute arbitrary shell commands with the same tool, bypassing the approval workflow and enabling silent exfiltration of API keys and other credentials. The weakness is an authorization bypass (CWE‑863) that can lead to data theft and broader system compromise.

All installations of PraisonAI by the vendor PraisonAI running a version older than 1.5.128 are vulnerable. The issue resides in the tool‑approval subsystem and affects any configuration where the execute_command API is exposed; therefore, every instance of the product before version 1.5.128 is at risk until the vulnerability is patched.

The CVSS score of 6.8 classifies the vulnerability as moderate severity. No public exploits are documented, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an initial benign command to populate the cache; once populated, an attacker can supply malicious arguments to the same tool without further user interaction. Attackers with local or remote access to the API can thus use this vector, making the risk moderate but urgent to address.