PraisonAI: Server-side request forgery via searxng_url in search tools
Summary
The praisonaiagents Python package, used by PraisonAI multi-agent teams, passes the LLM-controlled searxng_url parameter to HTTP requests without validating scheme, host, port or resolved address. Prompt-injected content can make the default search tool query internal JSON services, distinguish open and closed internal ports, and request cloud metadata endpoints, with the returned JSON entering the agent context. Exploitation requires that an agent processes attacker-controlled content, and the flaw is network-reachable without authentication.
Affected
- praisonaiagents (PyPI) before 1.6.62
- Sources conflict on whether 1.6.61 is fixed; treat 1.6.62 as the minimum safe version.
Fixed in
- praisonaiagents 1.6.62 (commit 2a855c4 and release v4.6.62 in the PraisonAI repository)
Workaround
No workaround documented by the vendor or in the CVE record.
Exploitation
- CISA SSVC lists exploitation as 'poc' (proof of concept available) and automatable as 'no'.
- No known exploitation in the wild; not listed as known exploited in the sources reviewed.
- The CVSS base score is 8.8 (NVD); VulDB scores it 6.3.
Our recommendation
- Upgrade praisonaiagents to version 1.6.62 or later in all environments.
- Until patched, disable or restrict the search tool for agents that process untrusted content, and do not pass LLM-controlled URLs to it.
- Restrict outbound traffic from agent hosts to internal address ranges and the cloud metadata address 169.254.169.254; enforce IMDSv2 on cloud VMs.
- Review logs for search requests to internal addresses or unusual ports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4pcv-mg8v-vrgf github.com
- Commit 2a855c4 (fix) github.com
- PraisonAI release v4.6.62 github.com
- OSV GHSA-4pcv-mg8v-vrgf osv.dev
- OpenCVE CVE-2026-57143 app.opencve.io
- VulDB 417193 vuldb.com
- HOL Guard CVE-2026-57143 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:24.
Original description (NVD)
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.
NVD references (4)
- https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33
- https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.