# CVE-2026-40150: MervinPraison PraisonAIAgents SSRF and Local File Read in web_crawl tool

Source: https://junglewise.ai/threats/cve-2026-40150-mervinpraison-praisonaiagents-ssrf-and-local-file-read-in-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40150 · Severity: high · CVSS 7.7 · Published 2026-04-09

PraisonAIAgents is a framework for building AI-driven agents. A vulnerability in its web crawling tool allows the AI to be tricked into accessing internal company data, private network services, or sensitive cloud credentials. This could lead to the theft of cloud access keys or the exposure of private files stored on the server where the agent is running.

Technologies: [MervinPraison PraisonAI Agents](https://junglewise.ai/threats/technologies/praisonai-agents), [Praisonaiagents](https://junglewise.ai/threats/technologies/praisonaiagents), [praisonaiagents (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonaiagents). Vendors: [MervinPraison](https://junglewise.ai/threats/vendors/mervinpraison), [Praison](https://junglewise.ai/threats/vendors/praison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-40150 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40150 being exploited in the wild.

**How severe is CVE-2026-40150?** High severity, with a CVSS score of 7.7, published 9 April 2026.

**Which products and versions are affected?** praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.128.

**Is there a fix for CVE-2026-40150?** Yes. praisonaiagents (PyPI): upgrade to 1.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40150 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40150?** Check whether you run MervinPraison PraisonAI Agents, Praisonaiagents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonaiagents (PyPI): upgrade to 1.5.128 or later

  ```sh
  pip install "praisonaiagents>=1.5.128"
  ```


## Technical details

The `web_crawl()` function in `praisonaiagents/tools/web_crawl_tools.py` fails to validate URLs before processing them. It lacks scheme allowlisting and does not block private IP ranges (e.g., 127.0.0.1, 169.254.169.254). When the `httpx` library is used, it follows redirects by default, enabling redirect-based SSRF. If `httpx` is missing, the tool falls back to `urllib.request.urlopen`, which supports the `file://` scheme, allowing arbitrary local file reads. Attackers can trigger this via direct prompts or prompt injection in crawled content. The issue is fixed in version 1.5.128.

## Affected products

- MervinPraison praisonaiagents < 1.5.128

## Identifiers

- CVE-2026-40150
- GHSA-8f4v-xfm9-3244
- PYSEC-2026-2945

## Timeline

- 2026-04-09: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 1.5.128

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [PraisonAI SearxNG URL validation bypass in search tools](https://junglewise.ai/threats/cve-2026-57143-praisonai-server-side-request-forgery-ssrf-in-searxng-search-web)
- [PraisonAI missing access control in API endpoints](https://junglewise.ai/threats/cve-2026-57118-praisonai-agentteam-launch-exposes-unauthenticated-remote-agent)
- [PraisonAI legacy SSE endpoint CORS and authentication bypass](https://junglewise.ai/threats/cve-2026-57112-praisonai-legacy-sse-endpoint-cors-and-authentication-bypass)
- [PraisonAI IMAP injection in email tools](https://junglewise.ai/threats/cve-2026-57130-praisonai-imap-injection-in-email-tools)
- [PraisonAI path traversal in file mention parsing](https://junglewise.ai/threats/cve-2026-57129-praisonai-path-traversal-in-file-mention-parsing)