Executive brief
PraisonAI, a system for managing multi-agent AI teams, contains a vulnerability in its command-line interface (CLI) that automatically processes web links found in user prompts. If a user is tricked into running a prompt containing a malicious link, the system will fetch data from internal or local network services that are normally inaccessible from the outside. This could allow an attacker to steal sensitive information from the user's local machine or internal network by injecting it into the AI's conversation context.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the PraisonAI direct-prompt CLI due to unrestricted URL fetching in the MentionsParser component. The CLI automatically expands '@url:' mentions using `urllib.request.urlopen()` without validating the destination address. An attacker can provide a crafted prompt that forces the application to fetch content from loopback addresses (localhost), private RFC1918 networks, or cloud metadata services. The fetched content is then prepended to the model's prompt context, leading to local information disclosure. The issue is fixed in PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 by implementing loopback and private address restrictions.
Affected products
- MervinPraison PraisonAI < 4.6.40
- MervinPraison praisonaiagents < 1.6.40
Timeline
- 2026-05-19: patched: Fixes merged in security hardening batch PR #1684
- 2026-07-21: advisory: GHSA-5cxw-77wg-jrf3 published