Executive brief
PraisonAI, an AI agent framework, is vulnerable to a security flaw that allows attackers to bypass internal network protections. By providing specially crafted web addresses, an attacker can force the system to connect to internal servers or services that should not be accessible from the outside. This could lead to the exposure of sensitive internal data or unauthorized access to private infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in PraisonAI due to a differential in how URLs are parsed by the Python 'urlparse' library and the 'requests' library. The '_validate_url' function uses 'urlparse' to extract the hostname for security checks; however, 'urlparse' misinterprets backslashes in certain contexts (e.g., 'http://127.0.0.1\\@1.1.1.1'), identifying a public IP as the host. Conversely, the 'requests' library treats the backslash as a path character and connects to the internal IP (127.0.0.1). This allows an unauthenticated remote attacker to bypass internal network blocks and access local services. The issue is fixed in version 1.6.32.
Affected products
- MervinPraison praisonaiagents <= 1.6.31
Timeline
- 2026-04-29: disclosed
- 2026-05-06: advisory
- 2026-05-08: other: NVD publication