GHSA-qwgj-rrpj-75xm

## Summary The Chainlit UI modules (`chat.py` and `code.py`) hardcode `config.approval_mode = "auto"` after loading administrator configuration from the `PRAISON_APPROVAL_MODE` environment variable, silently overriding any "manual" or "scoped" approval setting. This defeats the human-in-the-loop approval gate for all ACP tool executions, including shell command execution via `subprocess.run(..., shell=True)`. An authenticated user can instruct the LLM agent to execute arbitrary single-command shell operations on the server without any approval prompt. ## Details The application has a well-designed approval framework supporting `auto`, `manual`, and `scoped` modes, configured via the `PRAISON_APPROVAL_MODE` environment variable and loaded by `ToolConfig.from_env()` at `interactive_tools.py:81-106`. However, both UI modules unconditionally override this after loading: **`chat.py:156-159`:** ```python config = ToolConfig.from_env() # reads PRAISON_APPROVAL_MODE=manual config.workspace = os.getcwd() config.approval_mode = "auto" # hardcoded override, ignoring admin config ``` **`code.py:155-158`:** ```python config = ToolConfig.from_env() config.workspace = os.environ.get("PRAISONAI_CODE_REPO_PATH", os.getcwd()) config.approval_mode = "auto" # same hardcoded override ``` This flows to `agent_tools.py:347-348` in the `acp_execute_command` function: ```python auto_approve = runtime.config.approval_mode == "auto" # always True approved = await orchestrator.approve_plan(plan, auto=auto_approve) ``` The plan is auto-approved without user confirmation and reaches `action_orchestrator.py:458`: ```python result = subprocess.run( step.target, shell=True, # shell execution capture_output=True, text=True, cwd=str(workspace), timeout=30 ) ``` **Command sanitization is insufficient.** Two blocklists exist: 1. `_sanitize_command()` at `agent_tools.py:60-86` blocks: `$(`, `` ` ``, `&&`, `||`, `>>`, `>`, `|`, `;`, `&`, `\