CVE-2026-47395
Received Received - Intake

Server-Side Request Forgery in PraisonAI CLI

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execution begins. If a prompt contains `@url:<http-or-https-url>`, the CLI calls `MentionsParser.process(...)`. The `@url:` handler then performs a direct `urllib.request.urlopen()` request to the attacker-controlled URL and returns the response body. That response body is prepended to the final model prompt context. There is no loopback/private-address restriction, no metadata-service restriction, and no approval gate before the fetch. As a result, attacker-influenced prompt text can cause the operator's machine to fetch localhost-only HTTP resources and inject the response into model context. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-47395
EUVD
EUVD-2026-46303

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
praisonai praisonai to 4.6.40 (exc)
praisonai praisonai 4.6.40
praisonai praisonaiagents to 1.6.40 (exc)
praisonai praisonaiagents 1.6.40

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in PraisonAI versions before 4.6.40 allows the CLI to automatically fetch and inject content from URLs specified in prompts without restrictions. The CLI uses urllib.request.urlopen() to fetch attacker-controlled URLs and prepends the response to the model's prompt context. This can lead to local resource exposure.

Detection Guidance

Check for unusual outbound HTTP requests from the PraisonAI CLI process, especially to localhost or private IP ranges. Monitor logs for @url mentions in prompts that trigger unexpected fetches. Review network traffic for urllib.request.urlopen() calls to non-public addresses.

Impact Analysis

An attacker could manipulate prompt text to make your machine fetch sensitive local resources like localhost, admin panels, or internal services. The fetched content could then be exposed through logs, model output, or agent memory, potentially leaking confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Exposure of internal resources may result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade to PraisonAI version 4.6.40 or later and praisonaiagents version 1.6.40 or later. Avoid using the direct-prompt CLI with untrusted prompts. Implement network restrictions to block outbound requests to localhost or private IPs from the PraisonAI process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47395. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart