Most recent entries from all

fkie_cve-2026-47395

2026-09-29T18:10:26.559945+00:00

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execution begins. If a prompt contains `@url:`, the CLI calls `MentionsParser.process(...)`. The `@url:` handler then performs a direct `urllib.request.urlopen()` request to the attacker-controlled URL and returns the response body. That response body is prepended to the final model prompt context. There is no loopback/private-address restriction, no metadata-service restriction, and no approval gate before the fetch. As a result, attacker-influenced prompt text can cause the operator's machine to fetch localhost-only HTTP resources and inject the response into model context. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a fix.

GHSA-5cxw-77wg-jrf3 — PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

2026-09-29T18:10:26.560037+00:00

Affected: PyPI: praisonaiagents, PyPI: PraisonAI

### Summary

PraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execution begins.

If a prompt contains `@url:`, the CLI calls `MentionsParser.process(...)`. The `@url:` handler then performs a direct `urllib.request.urlopen()` request to the attacker-controlled URL and returns the response body. That response body is prepended to the final model prompt context.

There is no loopback/private-address restriction, no metadata-service restriction, and no approval gate before the fetch.

As a result, attacker-influenced prompt text can cause the operator's machine to fetch localhost-only HTTP resources and inject the response into model context.

Example:

```text @url:http://localhost.:8766/ summarize this ````

This causes PraisonAI to make an HTTP request to the local machine and prepend the fetched response body to the prompt that the model receives.

This is a narrow local SSRF / local content disclosure issue in automatic prompt preprocessing. It is not a remote server takeover.

### Details

The affected direct-prompt CLI path is in:

```text src/praisonai/praisonai/cli/main.py ```

The CLI imports and instantiates `MentionsParser` on the direct prompt path:

```python from praisonaiagents.tools.mentions import MentionsParser

parser = MentionsParser(workspace_path=os.getcwd())

if parser.has_mentions(prompt): mention_context, prompt = parser.process(prompt)

if mention_context: prompt = f"{menti…

PYSEC-2026-2903 — PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

2026-09-29T18:10:26.560147+00:00

Affected: PyPI: praisonai