Vulnerability · Published Apr 9, 2026 · Assigned by GitHub_M
CVE-2026-40150PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool
High 7.7
In plain English
A high-severity server-side request forgery in PraisonAIAgents from MervinPraison. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praisonaiagents/tools/web_crawl_tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. This allows an attacker (or prompt injection in crawled content) to force the agent to fetch cloud metadata endpoints, internal services, or local files via file:// URLs. This vulnerability is fixed in 1.5.128.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | praisonaiagents | 1.5.128 | GHSA-8f4v-xfm9-3244 |
| PyPI | praisonaiagents | 1.5.128 | PYSEC-2026-2945 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MervinPraison | PraisonAIAgents | < 1.5.128 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N