PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context.
This issue is fixed in praisonaiagents 1.6.62.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef…
security-advisories@github.com
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62
security-advisories@github.com
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-v…
security-advisories@github.com