CVE-2026-40160: MervinPraison PraisonAIAgents SSRF in web_crawl tool

Executive brief

PraisonAIAgents is a library for building AI-powered agents. A security flaw in its web crawling tool allows an attacker to trick an AI agent into accessing internal company servers or cloud metadata services. This could lead to the theft of sensitive information, such as cloud access credentials or internal database contents, which are then returned to the attacker.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `web_crawl` tool's httpx fallback path within `web_crawl_tools.py`. The component fails to validate user-supplied URLs before passing them to `httpx.AsyncClient.get()` with `follow_redirects=True`. An attacker can exploit this via direct interaction or indirect prompt injection to reach internal network resources, including cloud metadata endpoints (IMDSv1) and localhost. The vulnerability is present in default installations where Tavily or Crawl4AI are not configured. A fix is available in version 1.5.128 which implements proper scheme and IP address validation.

Affected products

• MervinPraison praisonaiagents >= 0.13.23, < 1.5.128

Timeline

• 2026-04-09: disclosed
• 2026-04-10: advisory

References

• https://api.github.com/users/Mundi-Xu
• https://github.com/Mundi-Xu
• https://api.github.com/users/Mundi-Xu/gists%7B/gist_id%7D
• https://api.github.com/users/Mundi-Xu/repos
• https://avatars.githubusercontent.com/u/43680784?v=4
• https://api.github.com/users/Mundi-Xu/events%7B/privacy%7D