PraisonAI CVE-2026-57143

Exploitation requires: (1) a PraisonAI agent running with the default tool profile that includes search_web/searxng_search (the vulnerable sink); (2) the agent ingesting attacker-controlled content - a web page, file, or upstream tool output - containing prompt-injection instructions; and (3) the LLM being induced to invoke the tool with an attacker-supplied searxng_url whose scheme/host/port/resolved-address are unvalidated (praisonaiagents < 1.6.62). Limiting factors: the attack is gated by UI:R because it depends on an agent actually processing malicious content and the model complying with the injected tool call; cloud-metadata/IAM credential theft further requires deployment in a cloud environment where 169.254.169.254 is reachable, and internal-service reads require SSRF-reachable internal targets.

This is a genuine, actionable risk for anyone running PraisonAI as an autonomous or semi-autonomous agent. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L, base 8.8) aligns well with the SSRF primitive described: network-reachable, low complexity, no authentication, scope changed (the agent server pivots to other internal systems), with high confidentiality impact from reading internal services and cloud-metadata (169.254.169.254) credentials. The one signal tempering raw severity is UI:R - exploitation depends on an agent ingesting attacker-controlled content, so it is not a direct unauthenticated hit on a listening service but a prompt-injection-mediated attack. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis; this is a disclosure-driven priority rather than a confirmed in-the-wild threat. The real-world weight comes from the fact that search_web/searxng_search are in the DEFAULT tool profile, making the sink reachable in typical deployments without special configuration - that makes it a real priority for PraisonAI operators even absent exploitation telemetry. Note a version inconsistency across sources (see confidence_notes) that should be verified before remediation.

An attacker plants prompt-injection instructions in content an agent will ingest (a web page, a document, or upstream tool output). When the LLM processes that content it is steered into calling the default search_web/searxng_search tool with an attacker-chosen searxng_url such as http://169.254.169.254/latest/meta-data/iam/security-credentials/, and the server dutifully fetches it and feeds the JSON response back into agent context, exposing internal services or cloud IAM credentials. No public exploit was identified at time of analysis, but the attack requires no authentication and only low complexity given the tool is enabled by default.