CVE-2026-47395: 
PraisonAI vulnerability analysis and mitigation

CVE-2026-47395 is a local Server-Side Request Forgery (SSRF) / local content disclosure vulnerability in PraisonAI's direct-prompt CLI that allows attacker-influenced prompt text to cause the operator's machine to fetch localhost-only HTTP resources and inject the response into the AI model's prompt context. It affects praisonai pip package versions ≤ 4.6.39 and praisonaiagents pip package versions ≤ 1.6.39. The vulnerability was published by MervinPraison on May 19, 2026, and added to the GitHub Advisory Database on May 29, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is improper input validation (CWE-200) in the MentionsParser class located in src/praisonai-agents/praisonaiagents/tools/mentions.py. The CLI's direct-prompt path in src/praisonai/praisonai/cli/main.py automatically calls MentionsParser.process(prompt) on raw user-supplied prompt text before any LLM invocation, and the @url: mention handler executes an unrestricted urllib.request.urlopen() call to any HTTP/HTTPS URL — including loopback addresses like http://localhost.:8766/ — without validating against private, loopback, link-local, or cloud metadata address ranges. The fetched response body is then prepended to the final model prompt context, enabling an attacker who can influence prompt text to read localhost-only services. A public PoC demonstrating the loopback fetch and context injection is included in the advisory (GitHub Advisory, PraisonAI Advisory).

An attacker who can influence the prompt text passed to PraisonAI's direct-prompt CLI can cause the operator's machine to read localhost-only HTTP resources — including local dashboards, admin panels, development servers, and internal web services bound to the loopback interface — and inject that content into the model's prompt context. The fetched data may subsequently be exposed through downstream logs, traces, model output, or agent memory depending on the operator's workflow. There is no integrity or availability impact, and this vulnerability does not enable unauthenticated remote server takeover; exploitation requires the ability to influence the prompt text an operator runs (GitHub Advisory).

1. Identify target: Confirm the target operator is using PraisonAI's direct-prompt CLI with praisonai ≤ 4.6.39 or praisonaiagents ≤ 1.6.39.
2. Identify local service: Determine a localhost-only HTTP service running on the operator's machine (e.g., a local admin panel, development server, or internal dashboard on a known port such as 8766).
3. Craft malicious prompt: Construct a prompt containing the @url: mention pointing to the target loopback resource, e.g.:

   @url:http://localhost.:8766/ summarize this

4. Deliver prompt: Influence the operator into running this prompt via the PraisonAI direct-prompt CLI (e.g., through a shared prompt template, social engineering, or a malicious configuration file).
5. Trigger fetch: When the operator executes the prompt, MentionsParser.process(...) is called automatically, which invokes _process_url_mention(...) and performs urllib.request.urlopen() to the loopback URL without any address validation.
6. Exfiltrate data: The response body from the local HTTP service is prepended to the model prompt context. The attacker can then retrieve the injected content through model output, logs, traces, or agent memory depending on the workflow (GitHub Advisory, PraisonAI Advisory).

• Network: Unexpected outbound HTTP requests from the PraisonAI process to 127.0.0.1 or localhost on non-standard ports; HTTP requests with User-Agent: Mozilla/5.0 (compatible; PraisonAI/1.0) to loopback addresses.
• Logs: Access logs on local HTTP services (e.g., development servers, admin panels) showing GET requests from 127.0.0.1 with the PraisonAI user-agent string; PraisonAI CLI logs showing prompt preprocessing activity involving @url: mentions.
• Process: The PraisonAI Python process spawning network connections to loopback addresses before LLM invocation; urllib activity to localhost or 127.0.0.1 observable via system call tracing (e.g., strace, dtrace) (GitHub Advisory).

Upgrade praisonai to version 4.6.40 or later and praisonaiagents to version 1.6.40 or later, which contain the patch for this vulnerability. As a workaround prior to patching, operators should avoid running untrusted or externally-supplied prompt text through the PraisonAI direct-prompt CLI, and should ensure that sensitive local HTTP services are not accessible on loopback ports that could be targeted. Network-level controls (e.g., firewall rules restricting loopback access from the PraisonAI process) may reduce exposure but are not a substitute for upgrading (GitHub Advisory, PraisonAI Advisory).