Executive brief
PraisonAIAgents is a framework for building AI-driven agents. A vulnerability in its web crawling tool allows the AI to be tricked into accessing internal company data, private network services, or sensitive cloud credentials. This could lead to the theft of cloud access keys or the exposure of private files stored on the server where the agent is running.
Technical details
The `web_crawl()` function in `praisonaiagents/tools/web_crawl_tools.py` fails to validate URLs before processing them. It lacks scheme allowlisting and does not block private IP ranges (e.g., 127.0.0.1, 169.254.169.254). When the `httpx` library is used, it follows redirects by default, enabling redirect-based SSRF. If `httpx` is missing, the tool falls back to `urllib.request.urlopen`, which supports the `file://` scheme, allowing arbitrary local file reads. Attackers can trigger this via direct prompts or prompt injection in crawled content. The issue is fixed in version 1.5.128.
Affected products
- MervinPraison praisonaiagents < 1.5.128
Timeline
- 2026-04-09: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 1.5.128