CVE-2026-57143
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.
- CVSS 3.1
- 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-20, CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4pcv-mg8v-vrgf | PyPI | praisonaiagents | <1.6.61 | 1.6.61 |
| PYSEC-2026-3530 | PyPI | praisonaiagents | <1.6.61 | 1.6.61 |
References
- https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33
- https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf