CVE-2026-60087: PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments

October 8, 2026

PraisonAI gates dangerous tools (file writes, deletes, shell/code execution) behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29r9-67vg-qj56
github.com/advisories/GHSA-29r9-67vg-qj56
nvd.nist.gov/vuln/detail/CVE-2026-60087
nvd.nist.gov/vuln/detail/CVE-2026-62164
www.vulncheck.com/advisories/praisonai-before-tool-approval-cache-bypass

Code Behaviors & Features

Detect and mitigate CVE-2026-60087 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →