{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40150", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-09T19:31:56.013Z", "datePublished": "2026-04-09T21:26:09.572Z", "dateUpdated": "2026-04-09T21:26:09.572Z"}, "containers": {"cna": {"title": "PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8f4v-xfm9-3244", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8f4v-xfm9-3244"}], "affected": [{"vendor": "MervinPraison", "product": "PraisonAIAgents", "versions": [{"version": "< 1.5.128", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T21:26:09.572Z"}, "descriptions": [{"lang": "en", "value": "PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praisonaiagents/tools/web_crawl_tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. This allows an attacker (or prompt injection in crawled content) to force the agent to fetch cloud metadata endpoints, internal services, or local files via file:// URLs. This vulnerability is fixed in 1.5.128."}], "source": {"advisory": "GHSA-8f4v-xfm9-3244", "discovery": "UNKNOWN"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praisonaiagents/tools/web_crawl_tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. This allows an attacker (or prompt injection in crawled content) to force the agent to fetch cloud metadata endpoints, internal services, or local files via file:// URLs. This vulnerability is fixed in 1.5.128."}], "id": "CVE-2026-40150", "lastModified": "2026-04-09T22:16:35.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-09T22:16:35.900", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8f4v-xfm9-3244"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.5.128)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "PraisonAIAgents", "source": "cna", "vendor": "MervinPraison"}, "product": "praisonaiagents", "vendor": "mervinpraison"}], "analysis": {"en": {"generated_at": "2026-04-09T22:39:36.577230+00:00", "value": {"mitigation_remediation": ["Upgrade Praison AIAgents to version 1.5.128 or later.", "If an immediate upgrade is not feasible, restrict the web_crawl function to accept only URLs from an approved allowlist and reject all others.", "Consider blocking internal endpoints and cloud metadata services at the firewall level to prevent unauthorized access.", "Monitor the system for unexpected or suspicious calls to web_crawl and investigate any anomalies."], "summary": {"action": "Immediate Patch", "impact": "Local File Read and SSRF"}, "threat_synthesis": {"affected_systems": "Praison AIAgents from MervinPraison is affected. Versions prior to 1.5.128 contain the vulnerability; the issue is fixed in 1.5.128 and later releases.", "description_and_impact": "The web_crawl() function in Praison AIAgents accepts user\u2011supplied URLs without any validation. The lack of scheme allowlisting, hostname/IP blocklisting, or private network checks lets an attacker or a malicious prompt inject an URL that points to internal services or local files. Attacks can thus read confidential files or access cloud metadata endpoints, leading to significant confidentiality breaches.", "risk_and_exploitability": "The CVSS score of 7.7 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack vector requires the attacker to supply a crafted URL to the agent\u2019s web_crawl tool or to inject malicious content that triggers such a call. Because no network restrictions exist, an internal attacker or one who can influence prompts can exploit this to read local files or reach internal network resources."}}}}, "created": "2026-04-10T08:38:06.282535+00:00", "updated": "2026-04-10T09:28:48.809037+00:00", "vendors": ["mervinpraison", "mervinpraison$PRODUCT$praisonaiagents"]}