CVE-2026-56840highAgent hijacking2026-10-23

CVE-2026-56840: PraisonAI's human approval for dangerous tools could be bypassed, plus file reads and unsigned Linear webhooks

Five PraisonAI CVEs published on 23 October 2026 cover bugs fixed in praisonai 4.6.59. Two let someone approve a dangerous tool call without the real approver: a tool argument that injects script into the HTTP approval dashboard, and any 'yes' typed in the Discord approval channel. The others let a prompt read files outside PraisonAI's storage and let anyone send forged Linear webhooks to LinearBot when no secret is set.

01.

What it is

CVE-2026-56840 (GHSA-63v4-w882-g4x2): HTTPApproval puts pending tool arguments into the approval dashboard HTML without escaping. An attacker-controlled argument runs script when a human opens the approval page, and that script can POST to /approve/{request_id}/decide so the tool call comes back approved. praisonai 4.5.2 through 4.6.57.

CVE-2026-56832 (GHSA-8579-rgg5-ph2m): DiscordApproval treats any later non-bot message in the approval channel that reads as approval, such as 'yes', as approving the pending dangerous tool call. It doesn't need to be a reply or come from a named approver. The advisory notes the Slack and Telegram backends also have no approver allow-list. praisonai 4.5.2 through 4.6.58.

CVE-2026-56834 (GHSA-j7qx-p75m-wp7g): the Dynamic Context Discovery artifact tools (artifact_head, artifact_tail, artifact_grep, artifact_chunk) read whatever path they're given, so anyone who can steer tool arguments, including through prompt injection, can read .env files, cloud credentials, SSH keys and other files the process can read. praisonai 3.8.1 through 4.6.58.

CVE-2026-56833 (GHSA-22cj-m4wf-fv2c): the Dynamic Context history and terminal-log tools join run_id and agent_id into paths without blocking absolute paths or '..', letting a caller read .jsonl and .log files outside the configured folder. praisonai 3.8.1 through 4.6.58.

CVE-2026-56837 (GHSA-fc26-m9pf-v56q): LinearBot listens on 0.0.0.0 and skips Linear-Signature checks when LINEAR_WEBHOOK_SECRET isn't set, so an unauthenticated caller can send a forged AgentSession event that the bot processes and answers under its Linear token. praisonai 4.6.56 through 4.6.58.

The GitHub advisories were published on 17 June 2026, so the fixed release has been out for months; the CVE IDs were only published on 23 October.

02.

How to check

Affected: praisonai (PyPI) from 3.8.1 (Dynamic Context bugs), 4.5.2 (approval bugs) or 4.6.56 (LinearBot) up to before 4.6.59.
You are at risk if you rely on PraisonAI's HTTP, Discord, Slack or Telegram approval flow to gate risky tools, expose Dynamic Context tools to agents that read untrusted content, or run LinearBot without LINEAR_WEBHOOK_SECRET.

03.

How to fix

Upgrade praisonai to 4.6.59 or later.
Use a private approval channel that only approvers can post in, always set LINEAR_WEBHOOK_SECRET, and don't give Dynamic Context tools to agents that handle untrusted input.

pip show praisonai | grep -i version

04.

Sources

More advisories for this tool