Executive brief
PraisonAI is a framework used to build and manage teams of AI agents. A security flaw in its file download tool allows an attacker to force the AI system to make requests to internal servers or cloud management services that should be private. This could lead to the theft of sensitive cloud credentials or unauthorized access to internal company data.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `FileTools.download_file()` function of the `praisonaiagents` package. The root cause is a failure to validate the `url` parameter before passing it to `httpx.stream()` with `follow_redirects=True`. An attacker can provide a malicious URL to reach internal network services or cloud metadata services (like AWS IMDSv1). This can be exploited via indirect prompt injection or direct API calls without authentication. Successful exploitation allows an attacker to exfiltrate sensitive information, such as IAM credentials, by writing them to a local file. The issue is fixed in version 1.5.95.
Affected products
- MervinPraison PraisonAI < 1.5.95
- MervinPraison praisonaiagents <= 1.5.94
Timeline
- 2026-03-31: advisory: GitHub Security Advisory published by vendor
- 2026-04-03: disclosed: CVE-2026-34954 published
- 2026-04-03: patched: Fixed in version 1.5.95