EUVD-2026-21513
GHSA-qq9r-63f6-v542
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionGitHub Advisory
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128.
AnalysisAI
Server-Side Request Forgery (SSRF) in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated attackers to manipulate LLM agents into crawling arbitrary internal URLs. The httpx fallback crawler accepts user-supplied URLs without host validation and follows redirects, enabling access to cloud metadata endpoints (169.254.169.254), internal services, and localhost. Response content is returned to the agent and may be exposed in attacker-visible output. This vulnerability is the default behavior on fresh installations without Tavily API keys or Crawl4AI dependencies. No public exploit identified at time of analysis.
Technical ContextAI
The vulnerability stems from CWE-918 implementation in web_crawl's httpx.AsyncClient.get() fallback path. User-controlled URLs pass directly to the HTTP client with follow_redirects=True and no allowlist validation. The absence of host checking enables LLM prompt injection attacks to trigger internal network reconnaissance via the agent's HTTP capabilities, bypassing standard network perimeter controls.
RemediationAI
Vendor-released patch: upgrade to PraisonAIAgents version 1.5.128 immediately. This release implements host validation and restricts internal network access in the httpx fallback crawler. Until patching, disable the web_crawl function entirely or enforce strict allowlists for crawlable domains at the application layer. Consider deploying network egress controls to block agent access to RFC 1918 private ranges and cloud metadata endpoints (169.254.169.254/32). Review agent output logs for evidence of internal URL crawling attempts. Full vendor advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qq9r-63f6-v542. Organizations using LLM agents with external input should implement defense-in-depth controls including prompt injection detection and network segmentation to limit blast radius of SSRF exploitation.
More in Praisonaiagents
View allSSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary she
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call n
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAIAgents multi-agent system allows authenticated attackers to force internal netwo
Environment variable exfiltration in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated remote attackers t
PraisonAIAgents versions prior to 1.5.128 allow unauthenticated local attackers to read arbitrary files from the filesys
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today