PraisonAI multi-agent advisory wave: approval bypass, unauthenticated webhooks, sandbox escape, dangerous-tool policy bypass, path traversal (14 CVEs)

A large concurrent advisory wave fixed in PraisonAI 4.6.59–4.6.61 addressed multiple high/CVSS 7.2–8.8 flaws: human-approval bypasses in the Discord and HTTP approval flows, a Slack app_mention handler that skips the allow-list policy, an optional-required LinearBot webhook secret on a 0.0.0.0 listener, a SandlockSandbox native() path that weakens the kernel sandbox, shell-command injection in the compute-bridging file ops, template loader/cache path traversal, a dangerous-tool policy bypass, filesystem-backed Dynamic Context tools honoring arbitrary run_id/agent_id/artifact paths, unauthenticated A2U event streaming, and a webhook-validation binding gap.

These are the orchestration-layer failure modes of a multi-agent deployment: a human approval can be spoofed or injected, a bot webhook can be hit by anyone, the sandbox can be withdrawn, and attacker-steered arguments can traverse the filesystem or run shell commands. Together they show that agent approval UX and policy enforcement are boundary controls that must not be trusted as hardening.

Aggregate: (a) DiscordApproval approves a pending dangerous tool call when any later non-bot message in the channel is classified as 'yes' (CVE-2026-56832); (b) HTTPApproval renders attacker-controlled tool arguments directly into the approval dashboard HTML → JavaScript injection into a human-opened approval page (CVE-2026-56840); (c) Slack bot applies allowed_users/allowed_channels policy in the message handler but not the adjacent app_mention handler (CVE-2026-56835); (d) LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional, so signature verification is skipped (CVE-2026-56837); (e) SandlockSandbox native() path lets callers configure allowed filesystem/network paths, breaking the kernel-enforced sandbox (CVE-2026-57144); (f) LocalManagedAgent/SandboxedAgent compute bridging converts read_file/list_files/write_file into shell command strings via raw formatting → command injection (CVE-2026-57117); (g) template loader stores a user-controlled GitHub template path/ref verbatim and the cache layer joins it into a path → path traversal (CVE-2026-57113); (h) recipe execution dangerous-tool policy checks only tools declared in TEMPLATE and is bypassable (CVE-2026-56838 / 57142); (i) Dynamic Context tools accept run_id/agent_id from the tool caller to build filesystem paths (CVE-2026-56833 / 56834); (j) A2U event stream and subscription routes remain unauthenticated (CVE-2026-57146); (k) Async Jobs webhook validation of loopback/private targets is not bound to the request (CVE-2026-57114); (l) a workspace member can permanently delete any resource created by the owner or other members (CVE-2026-57121); (m) installed console recipe command dispatches to a deprecated Typer path (CVE-2026-56836).

PraisonAI (MervinPraison) 3.8.1–4.5.x to before 4.6.59/4.6.61; praisonai-platform (workplace) 0.1.4 to before 0.1.5

Upgrade PraisonAI to 4.6.59–4.6.61 (and praisonai-platform to 0.1.5). For each issue the respective GHSA (GHSA-8579-rgg5-ph2m, GHSA-63v4-w882-g4x2, GHSA-qvpf-j64c-jmhr, GHSA-fc26-m9pf-v56q, GHSA-6jcq-6546-qrrw, GHSA-w6h2-fr4q-xvxv, GHSA-f44v-7qgw-9gh9, GHSA-v847-hxxw-3pxg, GHSA-7qw2-w5rc-37x2, GHSA-22cj-m4wf-fv2c, GHSA-j7qx-p75m-wp7g, GHSA-jxcw-qp4h-6jfq, GHSA-rjvw-7vvw-549v, GHSA-rh39-9c67-59mh, GHSA-5qw8-f2g9-ff29). Don't expose bots/webhooks/sandbox surfaces without auth; require explicit allow_dangerous_tools and webhook secrets.