PraisonAI’s HTTPApproval dashboard renders tool arguments without escaping, allowing an attacker to inject JavaScript into the approval page. When a human user opens the URL to review a risky tool request, the injected script executes in the same origin and can POST to the /approve/{request_id}/decide endpoint, causing the request to be approved automatically. This flaw can be exploited to approve malicious tool executions by users who normally would need explicit approval, effectively bypassing security controls. The vulnerability is a stored cross‑site scripting flaw (CWE‑79) with a CVSS score of 8.8.

The affected product is MervinPraison’s PraisonAI, version 4.5.2 through 4.6.58 inclusive. The fix is delivered in version 4.6.59 and later.

The CVSS score of 8.8 indicates a high severity impact. The EPSS score is not reported, but the vulnerability remains widespread as it relies on standard web interaction that a human user will perform when reviewing approvals. Although the vulnerability is not listed in the CISA KEV catalog, its active exploitation potential is significant because the payload runs with the dashboard origin, granting the attacker the same privileges as the approving user. Attackers can exploit this flaw through crafted tool arguments that the system accepts and renders; no additional credentials are required beyond the normal approval interface.