Summary
PraisonAI's HTTPApproval component renders tool approval arguments directly into dashboard HTML without safely encoding attacker-controlled content. When a human opens a crafted approval page, injected JavaScript may run in the dashboard's origin and approve a pending tool request without intended authorization.
PraisonAI's HTTPApproval component renders tool approval arguments directly into dashboard HTML without safely encoding attacker-controlled content. When a human opens a crafted approval page, injected JavaScript may run in the dashboard's origin and approve a pending tool request without intended authorization.
Affected context
The vulnerability occurs in PraisonAI deployments using the HTTPApproval dashboard to review pending tool requests. It becomes risky when an attacker can influence tool arguments that are displayed in the approval page and a human reviewer opens the associated approval URL in a browser session with permission to decide the request.
The vulnerability occurs in PraisonAI deployments using the HTTPApproval dashboard to review pending tool requests. It becomes risky when an attacker can influence tool arguments that are displayed in the approval page and a human reviewer opens the associated approval URL in a browser session with permission to decide the request.
Exploit preconditions
- Attack surface: The HTTPApproval web dashboard and its approval pages
- Required access: Ability to supply or influence a tool argument displayed in a pending request
- Trigger point: A reviewer opens the affected approval URL
- Required browser state: The reviewer has an authenticated or otherwise authorized dashboard session
- Why exploitation is possible: Untrusted argument content is inserted into HTML, allowing script execution in the dashboard origin and interaction with the approval decision endpoint
- Attack surface: The HTTPApproval web dashboard and its approval pages
- Required access: Ability to supply or influence a tool argument displayed in a pending request
- Trigger point: A reviewer opens the affected approval URL
- Required browser state: The reviewer has an authenticated or otherwise authorized dashboard session
- Why exploitation is possible: Untrusted argument content is inserted into HTML, allowing script execution in the dashboard origin and interaction with the approval decision endpoint
Why this happens
The underlying bug is improper output encoding of untrusted tool arguments before they are placed into HTML. This creates a cross-site scripting condition under CWE-79, allowing attacker-controlled content to be interpreted as active browser code rather than inert data. Because the script executes within the dashboard origin, it may act with the reviewer's available permissions.
The underlying bug is improper output encoding of untrusted tool arguments before they are placed into HTML. This creates a cross-site scripting condition under CWE-79, allowing attacker-controlled content to be interpreted as active browser code rather than inert data. Because the script executes within the dashboard origin, it may act with the reviewer's available permissions.
Potential impact
- A pending tool request may be approved without the reviewer's informed consent
- Protected approval workflows could be bypassed
- The attacker could cause actions available to the approved tool to execute
- Sensitive dashboard data or session-authorized operations could be exposed
- Downstream systems or data could be affected by an unauthorized tool action
- A pending tool request may be approved without the reviewer's informed consent
- Protected approval workflows could be bypassed
- The attacker could cause actions available to the approved tool to execute
- Sensitive dashboard data or session-authorized operations could be exposed
- Downstream systems or data could be affected by an unauthorized tool action
General mitigation guidance
Mitigation generally focuses on treating all tool arguments as untrusted data
and ensuring context-appropriate output encoding before rendering them in
HTML. Prefer safe templating and DOM APIs that create text rather than
interpreted markup, and avoid constructing HTML from concatenated user input.
Additional defensive patterns include:
- Enforcing a restrictive Content Security Policy as defense in depth
- Validating approval identifiers and decision requests on the server
- Requiring explicit server-side authorization for every approval action
- Applying least privilege to dashboard users and tool execution identities
- Reducing the amount of sensitive data exposed in approval pages
- Using secure browser session and cookie policies
Mitigation generally focuses on treating all tool arguments as untrusted data
and ensuring context-appropriate output encoding before rendering them in
HTML. Prefer safe templating and DOM APIs that create text rather than
interpreted markup, and avoid constructing HTML from concatenated user input.
Additional defensive patterns include:
- Enforcing a restrictive Content Security Policy as defense in depth
- Validating approval identifiers and decision requests on the server
- Requiring explicit server-side authorization for every approval action
- Applying least privilege to dashboard users and tool execution identities
- Reducing the amount of sensitive data exposed in approval pages
- Using secure browser session and cookie policies
How teams detect issues like this
Detection can include static analysis for string interpolation, concatenation,
or template rendering of tool arguments into HTML without contextual escaping.
Code review should examine every dashboard output path, including attributes,
script-adjacent contexts, and dynamically generated approval controls.
Security tests can submit harmless HTML-like markers and verify that they are
rendered as text rather than interpreted markup. Policy enforcement may
require approved templating helpers, contextual encoding, Content Security
Policy checks, and automated dependency or code-review scanning.
Detection can include static analysis for string interpolation, concatenation,
or template rendering of tool arguments into HTML without contextual escaping.
Code review should examine every dashboard output path, including attributes,
script-adjacent contexts, and dynamically generated approval controls.
Security tests can submit harmless HTML-like markers and verify that they are
rendered as text rather than interpreted markup. Policy enforcement may
require approved templating helpers, contextual encoding, Content Security
Policy checks, and automated dependency or code-review scanning.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
