PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in the same session.

Affected: PyPI: praisonaiagents

## Summary

PraisonAI gates dangerous tools (file writes, deletes, shell/code execution) behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments.

## Root cause

`ApprovalRegistry.is_already_approved` (`src/praisonai-agents/praisonaiagents/approval/registry.py`, around line 181) returns `True` whenever the tool name is present in a per-run context set. The cache is keyed on tool name only — arguments are not part of the key.

`approve_sync` / `approve_async` (around lines 224-226 / 278-279) short-circuit on that cache before the approval backend is consulted.

`clear_approved` (around lines 186-187) is the only routine that clears the cache, but it is never invoked in the shipped library (only in tests). The cache persists for the entire agent run and is inherited by child tasks via `contextvars`.

Critical-tier tools (`execute_command`, `execute_code`) are exempt from the cache. But high-risk tools like `write_file` are not.

## Proof of concept

```python from praisonaiagents.approval.registry import ApprovalRegistry from praisonaiagents.approval.protocols import ApprovalDecision, ApprovalRequest

class CountingBackend: def __init__(self): self.prompts = [] def request_approval_sync(self, request): self.prompts.append((request.tool_name, dict(request.arguments))) return ApprovalDecision(approved=True, rea…

Affected: PyPI: praisonaiagents

## Summary

PraisonAI gates dangerous tools (file writes, deletes, shell/code execution) behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments.

## Root cause

`ApprovalRegistry.is_already_approved` (`src/praisonai-agents/praisonaiagents/approval/registry.py`, around line 181) returns `True` whenever the tool name is present in a per-run context set. The cache is keyed on tool name only — arguments are not part of the key.

`approve_sync` / `approve_async` (around lines 224-226 / 278-279) short-circuit on that cache before the approval backend is consulted.

`clear_approved` (around lines 186-187) is the only routine that clears the cache, but it is never invoked in the shipped library (only in tests). The cache persists for the entire agent run and is inherited by child tasks via `contextvars`.

Critical-tier tools (`execute_command`, `execute_code`) are exempt from the cache. But high-risk tools like `write_file` are not.

## Proof of concept

```python from praisonaiagents.approval.registry import ApprovalRegistry from praisonaiagents.approval.protocols import ApprovalDecision, ApprovalRequest

class CountingBackend: def __init__(self): self.prompts = [] def request_approval_sync(self, request): self.prompts.append((request.tool_name, dict(request.arguments))) return ApprovalDecision(approved=True, rea…