CVE-2026-60087: PraisonAI Caching Flaw Allows Arbitrary Tool Execution Without Re-Prompting
Summary
CVE-2026-60087: PraisonAI gates dangerous tools (file writes, deletes, shell/code execution) behind an interactive approval prompt. Affects praisonaiagents versions < 1.6.78. Fixed in 1.6.78. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PraisonAI is an open-source tool designed to facilitate human-in-the-loop interactions for executing potentially dangerous operations, such as file manipulation and code execution. It employs an interactive approval mechanism to ensure that sensitive actions are reviewed by a human operator. However, a flaw in its approval caching mechanism allows previously approved tools to be executed with arbitrary arguments without further human review, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from the ApprovalRegistry.is_already_approved method, which caches approvals based solely on the tool name, ignoring the specific arguments provided. This means that once a tool is approved, it can be executed multiple times with different, potentially harmful arguments without prompting the user again. The cache persists throughout the agent's runtime and is inherited by child tasks, allowing malicious actors to exploit this flaw to execute harmful commands or write files to sensitive locations without additional oversight.
How To Fix
Latest published version: 1.7.14 as of 22 Oct 2026
pip install --upgrade "praisonaiagents==1.7.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.78
This is the first release that contains the fix.
pip install --upgrade "praisonaiagents==1.6.78"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually clear the approval cache by invoking the clear_approved method after each critical operation, although this method is not included in the shipped library and is primarily for testing purposes. Here is a code snippet demonstrating how to clear the cache:
from praisonaiagents.approval.registry import ApprovalRegistry
reg = ApprovalRegistry()
reg.clear_approved() # Clear the approval cache
Conclusion
In summary, CVE-2026-60087 is a significant vulnerability in the PraisonAI package that allows for the execution of potentially harmful commands without proper user approval. It is crucial for users to update to the patched version to mitigate this risk and consider implementing additional safeguards in their applications.
See every vulnerability recorded for praisonaiagents →
FAQ
CVE-2026-60087 is a vulnerability in the PraisonAI package that allows previously approved tools to be executed with arbitrary arguments without further human approval.
If your application uses PraisonAI and does not update to the patched version, it may allow unauthorized execution of commands or file manipulations, leading to potential data loss or security breaches.
If an immediate update is not possible, consider implementing the provided workaround to clear the approval cache after each critical operation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup at Vulert Scanner.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for praisonaiagents.
