CVE-2026-34954
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In PraisonAI before version 1.5.95, the FileTools.download_file() function does not validate the URL parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker controlling the URL can reach any host accessible from the server, including cloud metadata and internal services.
Risk Assessment
Attackers can exploit this vulnerability to scan internal networks, steal cloud metadata, or attack other internal services, potentially leading to privilege escalation and data leakage.
Recommendation
Update PraisonAI to version 1.5.95 or later immediately. In the meantime, restrict access to the download_file function and enforce strict URL validation.
Other vulnerabilities in PraisonAI
See all- CVE-2026-55533High
PraisonAI before version 4.6.58 has a flaw in create_auth_middleware() that allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled.
- CVE-2026-55532High
PraisonAI before version 4.6.58 has a flaw in MCP HTTP Stream _validate_origin that uses startswith, allowing attacker-controlled localhost.attacker.com origin to pass the allowlist. A webpage can send text/plain requests without preflight and invoke tools without an API key, including file writes.
- CVE-2026-55538High
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. Missing or incorrect bearer and X-API-Key values still reach agent execution. This issue is fixed in version 4.6.58.
- CVE-2026-55537High
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor._send_webhook() later performs a fresh lookup, allowing DNS changes to direct the request to an internal service. This issue is fixed in version 4.6.58.
- CVE-2026-55531Medium
PraisonAI before version 4.6.58 has a vulnerability in the MCP HTTP Stream handler where the mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticated attacker can exhaust memory.
- CVE-2026-55530Medium
PraisonAI before version 1.6.58 has a vulnerability in the ast_grep_rewrite function, which lacks the @require_approval decorator used by sibling mutation tools. With dry_run=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected authorization gate.
- CVE-2026-55525High
PraisonAI is a multi-agent system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.
- CVE-2026-61434High
A vulnerability in PraisonAI before version 4.6.78 allows bypassing the shell command allowlist by using find's built-in actions (-exec, -execdir, -delete). Attackers can execute unauthorized commands, read or delete files without triggering shell metacharacter filters.
- CVE-2026-61432Medium
A path traversal vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 in the FastContext feature. The FastContextAgent.execute_tool() function does not properly validate absolute paths or canonicalize relative paths, allowing reading, searching, and enumerating files outside the intended workspace directory.
- CVE-2026-61431Medium
PraisonAI before version 4.6.78 contains a path traversal vulnerability in the ContextGatherer component that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.
Original NVD description (English source)
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. This issue has been patched in version 1.5.95.