CVE-2026-47395 PUBLISHED

PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

Assigner: GitHub_M
Reserved: 19.05.2026 Published: 21.07.2026 Updated: 21.07.2026

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:<http-or-https-url>, the CLI calls MentionsParser.process(...). The @url: handler then performs a direct urllib.request.urlopen() request to the attacker-controlled URL and returns the response body. That response body is prepended to the final model prompt context. There is no loopback/private-address restriction, no metadata-service restriction, and no approval gate before the fetch. As a result, attacker-influenced prompt text can cause the operator's machine to fetch localhost-only HTTP resources and inject the response into model context. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a fix.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS Score: 5.5

Product Status

Vendor MervinPraison
Product PraisonAI
Versions
  • Version < 4.6.40 is affected
Vendor MervinPraison
Product praisonaiagents
Versions
  • Version < 1.6.40 is affected

References

Problem Types

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE