Technical impact
PraisonAI versions prior to 1.6.78 cache tool approval decisions based solely on tool name, allowing a previously approved non‑destructive tool to be invoked later with arbitrary arguments without re‑verification. An attacker who has first obtained approval for a benign operation can subsequently execute dangerous file write operations using unreviewed parameters within the same session, thereby gaining unauthorized privileged actions.
Affected Systems
All installations of MervinPraison PraisonAI earlier than version 1.6.78 are affected. Any deployment running those affected releases is vulnerable to the approval cache bypass and the associated privilege escalation.
Risk and Exploitability
The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests the likelihood of widespread exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a session where the attacker has already obtained approval for a benign tool; within that session the attacker can reuse the cached approval to invoke the tool with malicious arguments.
Github GHSA