PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
Date: 2026-06
Affected: pip/praisonai
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CWE: CWE-345
CWE-863
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

# DiscordApproval accepts unrelated channel messages as dangerous-tool approvals ## Summary `praisonai.bots.DiscordApproval` approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as `yes`. The decision is not bound to: - a Discord reply to the approval message; - a Discord thread created for that request; - a Discord interaction/button callback for that request; - an explicit approver user allowlist; or - an approval nonce visible only to intended approvers. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending `yes` after the approval message appears. The same local PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. ## Affected Product - Repository: `MervinPraison/PraisonAI` - Ecosystem: `pip` - Package: `praisonai` - Component: Python messaging approval backends - Primary affected file: `src/praisonai/praisonai/bots/_discord_approval.py` - Related sibling files: - `src/praisonai/praisonai/bots/_slack_approval.py` - `src/praisonai/praisonai/bots/_telegram_approval.py` - Latest PyPI version validated: `4.6.58` - Current `origin/main` validated: `1ad58ca02975ff1398e


Mitigations:

Architectural layers (MAESTRO):