CVE-2026-47395: PraisonAI SSRF Vulnerability

CVE-2026-47395 Overview

CVE-2026-47395 affects PraisonAI, a multi-agent teams system, in versions prior to 4.6.40 (corresponding to praisonaiagents version 1.6.40). The direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution starts. When a prompt contains @url:<http-or-https-url>, the CLI invokes MentionsParser.process(...), which issues a direct urllib.request.urlopen() request to the attacker-controlled URL and prepends the response body to the model prompt context. The handler enforces no loopback or private-address restriction, no cloud metadata-service restriction, and no approval gate. This flaw is classified under [CWE-200] Information Exposure.

Critical Impact
Attacker-influenced prompt text can force the operator's machine to fetch localhost-only or internal HTTP resources and inject the responses into model context, exposing sensitive data.

Affected Products

PraisonAI versions prior to 4.6.40
praisonaiagents versions prior to 1.6.40
Deployments using the PraisonAI direct-prompt CLI with @url: mention expansion

Discovery Timeline

2026-07-21 - CVE-2026-47395 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-47395

Vulnerability Analysis

The vulnerability resides in the _process_url_mention handler within src/praisonai-agents/praisonaiagents/tools/mentions.py. When the direct-prompt CLI parses input, it scans for @url: tokens and expands each into an HTTP fetch before the model executes. The handler passes the URL directly to urllib.request.urlopen() without validation. The response body is then concatenated into the prompt context sent to the language model. Because the fetch runs on the operator's local machine, requests originate from a trusted network position. An attacker who controls or influences any part of the prompt text can pivot the operator's host to reach services bound to 127.0.0.1, private RFC1918 ranges, or cloud instance metadata endpoints. The retrieved data is silently injected into the model context and can be exfiltrated via subsequent model responses.

Root Cause

The root cause is missing URL validation and the absence of a user approval gate in the @url: mention handler. No allowlist, loopback filter, or private-address check exists before the outbound request. Prompt content is treated as trusted input despite being attacker-influenceable.

Attack Vector

Exploitation requires local user interaction: the operator must run the direct-prompt CLI with a prompt containing an attacker-supplied @url: mention. This can occur through copy-pasted instructions, shared prompt templates, or indirect prompt injection from untrusted content. The CLI then fetches http://localhost:<port>/, http://169.254.169.254/latest/meta-data/, or any internal endpoint and injects the response into the model context.

python

# Security patch in src/praisonai-agents/praisonaiagents/tools/mentions.py
def _process_url_mention(self, url: str) -> Optional[str]:
    """Process @url:https://... mention."""
    try:
        from praisonaiagents.tools.spider_tools import SpiderTools

        if not SpiderTools()._validate_url(url):
            return f"# URL: {url}\n[Blocked: URL is not allowed]"

        import urllib.request

        req = urllib.request.Request(
# Source: https://github.com/MervinPraison/PraisonAI/commit/b0d8f777528f3253a0cfb0a3ef65455da6ae32f6

The patch adds a SpiderTools()._validate_url(url) check that blocks disallowed URLs before the fetch. A companion change to spider_tools.py imports ipaddress and socket to resolve hostnames and reject loopback and private ranges.

Detection Methods for CVE-2026-47395

Indicators of Compromise

Outbound HTTP requests from developer workstations to 127.0.0.1, localhost, or RFC1918 addresses originating from Python urllib User-Agent strings during PraisonAI CLI sessions
Access attempts against cloud metadata endpoints such as 169.254.169.254 from hosts running PraisonAI
Prompt logs or shell history containing @url: tokens pointing to internal or link-local hosts

Detection Strategies

Inspect PraisonAI prompt inputs and agent logs for @url: mentions targeting loopback, private, or metadata addresses
Correlate process telemetry showing python/praisonai processes making outbound HTTP requests to non-routable destinations
Alert on installed PraisonAI packages below version 4.6.40 or praisonaiagents below 1.6.40 via software inventory

Monitoring Recommendations

Enable egress logging on developer endpoints and flag connections from AI tooling to internal services
Monitor DNS resolutions for metadata service hostnames initiated by Python interpreters
Track command-line arguments for PraisonAI invocations and archive prompt content for review

How to Mitigate CVE-2026-47395

Immediate Actions Required

Upgrade PraisonAI to version 4.6.40 or later and praisonaiagents to 1.6.40 or later
Audit shared prompt templates and playbooks for @url: mentions before execution
Restrict operator workstations from reaching cloud metadata endpoints and unnecessary internal services

Patch Information

The fix landed in GitHub Pull Request 1684 and commit b0d8f77. It routes @url: fetches through SpiderTools._validate_url(), which uses ipaddress and socket to reject loopback and private addresses. Full details are in GitHub Security Advisory GHSA-5cxw-77wg-jrf3.

Workarounds

Avoid pasting untrusted prompt content into the PraisonAI direct-prompt CLI until the upgrade is complete
Block outbound access from workstations to 169.254.169.254 and other metadata endpoints via host firewall rules
Run PraisonAI inside a network-restricted container with no route to internal services or loopback bindings on the host

bash

# Upgrade to the patched releases
pip install --upgrade "praisonai>=4.6.40" "praisonaiagents>=1.6.40"

# Verify installed versions
pip show praisonai praisonaiagents | grep -E "Name|Version"