{"id":"CVE-2026-57143","published":"2026-10-12T19:16:39.110","lastModified":"2026-10-16T20:04:29.760","description":"PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","cwes":["CWE-20","CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33","tags":[]},{"url":"https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62","tags":[]},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf","tags":[]},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf","tags":[]}],"exploitRefs":[{"url":"https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33","tags":[]},{"url":"https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62","tags":[]},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf","tags":[]},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf","tags":[]}],"hasPoc":true,"ai":{"summary":"A vulnerability in PraisonAI allows attackers to inject arbitrary URLs into search requests, potentially enabling access to internal services and cloud metadata through unvalidated LLM-controlled parameters.","exploitability":"Moderately difficult to exploit as it requires an attacker to control an LLM prompt that influences the search URL parameter, but once achieved, can lead to information disclosure and internal service enumeration.","blast_radius":"The impact could be significant as attackers might gain access to internal JSON services, distinguish open ports, and retrieve cloud metadata, potentially leading to further exploitation of internal systems.","remediation":"Upgrade to praisonaiagents 1.6.62 or later to fix the URL validation issue in searxng_search and search_web providers.","detection":"Monitor for requests to unexpected internal IP addresses or ports in the search provider logs, particularly those originating from LLM-generated URLs that were not validated for scheme, host, or port.","tags":["web","llm","information-disclosure"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:57:50.711Z"}}