Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-60087 · GHSA-29r9-67vg-qj56

PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments

Risk score
47/100
CVSS
6.1 v3.1
Exploit chance (30 days)
0.1%
Published
15 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in…
Affected
praisonaiagents (pip) <= 1.6.77
Fix
Upgrade praisonaiagents to 1.6.78 or later.
Exploitation
Public proof of concept

Story map

Story map: praisonaiagentsTHE FLAWSTHE FIXCVE-2026-60087PraisonAI: Human-in-the-looptool approval is cached by toolname and silently reused for…CVSS 6.1 · EPSS 0%CVE-2026-61447PraisonAI: CodeAgent ExecutesLLM-Generated Code WithoutSandboxing and Leaks All…CVSS 10.0 · EPSS 2%CVE-2026-61430PraisonAI: DNS rebindingbypass in `web_crawl` SSRFprotection allows internal…CVSS 8.5 · EPSS 0%CVE-2026-61429PraisonAI:Crawl4AI/Chromium backend isalso affected by the…CVSS 8.5 · EPSS 0%Upgrade praisonaiagents1.6.78or later on your release lineWho is exposedpraisonaiagents (pip) <= 1.6.77RED · ACT TODAYpraisonaiagentsCodeAgent._execute_python()executes LLM-generated Pythoncode in a subprocess with thecomplete parent-processenvironment (os.environ.copy()),zero AST validation, zero importrestrictions, and no sandbox…Where it standsPublic proof of conceptCONNECTS TOSame weaknessIncorrect authorisation (CWE-863)336 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

praisonaiagents: Red, act today. CodeAgent._execute_python() executes LLM-generated Python code in a subprocess with the complete parent-process environment (os.environ.copy()), zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfig(sandbox=True) is explicitly set. This allows an attacker who can influence LL…

The flaws

  • CVE-2026-60087: PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments (CVSS 6.1 · EPSS 0%)
  • CVE-2026-61447: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets (CVSS 10.0 · EPSS 2%)
  • CVE-2026-61430: PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure (CVSS 8.5 · EPSS 0%)
  • CVE-2026-61429: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass (CVSS 8.5 · EPSS 0%)

The fix

Upgrade praisonaiagents: 1.6.78 or later on your release line

Who is exposed: praisonaiagents (pip) <= 1.6.77

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.1 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
praisonaiagentspip<= 1.6.771.6.78

References

Original description

PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in the same session.

Last activity 8 Oct 2026. Patch Forecast updates every hour.