EUVD-2026-21170
GHSA-8f4v-xfm9-3244
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionGitHub Advisory
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praisonaiagents/tools/web_crawl_tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. This allows an attacker (or prompt injection in crawled content) to force the agent to fetch cloud metadata endpoints, internal services, or local files via file:// URLs. This vulnerability is fixed in 1.5.128.
AnalysisAI
Server-side request forgery in PraisonAIAgents multi-agent system allows authenticated attackers to force internal network reconnaissance and data exfiltration through unvalidated URL crawling. The web_crawl() function in versions prior to 1.5.128 accepts arbitrary URLs from AI agents without scheme allowlisting, hostname blocking, or private network checks, enabling access to cloud metadata endpoints (AWS/Azure/GCP), internal services, and local filesystems via file:// URIs. Exploitation requires low-privileged authenticated access with network reachability and no user interaction. No public exploit identified at time of analysis.
Technical ContextAI
Root cause is absence of input validation in praisonaiagents/tools/web_crawl_tools.py web_crawl() function. CWE-918 server-side request forgery occurs when agent-supplied URLs bypass all security controls: no URI scheme validation, no RFC1918 private IP filtering, no localhost/metadata endpoint blocklist. Attack vector includes prompt injection in previously crawled content triggering recursive SSRF chains.
RemediationAI
Vendor-released patch: version 1.5.128 implements URL validation controls including scheme allowlisting and private network filtering. Organizations must upgrade immediately to 1.5.128 or later. Review application logs for historical SSRF attempts targeting RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8, ::1), and cloud metadata endpoints (169.254.169.254, fd00:ec2::254). As temporary workaround if upgrade delayed, implement network egress filtering to block agent worker processes from accessing internal networks and apply web application firewall rules rejecting file://, gopher://, dict:// schemes. Vendor advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8f4v-xfm9-3244
More in Praisonaiagents
View allSSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary she
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call n
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Environment variable exfiltration in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated remote attackers t
Server-Side Request Forgery (SSRF) in PraisonAIAgents versions prior to 1.5.128 allows unauthenticated attackers to mani
PraisonAIAgents versions prior to 1.5.128 allow unauthenticated local attackers to read arbitrary files from the filesys
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today