CVE-2026-47395: PraisonAI SSRF — MEDIUM

CISO Take

PraisonAI's direct-prompt CLI blindly fetches any URL embedded in @url: mentions — including loopback addresses like localhost and 127.0.0.1 — and injects the HTTP response body directly into the model's prompt context before the LLM runs. Any workflow that accepts externally-controlled input (shared scripts, document pipelines, user-submitted prompts) becomes an SSRF vector: an attacker who can inject @url:http://localhost:8080/ into a prompt will silently harvest local admin panels, development servers, Jupyter instances, or cloud metadata endpoints, with the data surfacing in model output, logs, or traces. The CVSS vector (AV:L/AC:L/PR:N/UI:R/C:H) reflects low attack complexity and high confidentiality impact with no privileges required — though the local attack vector bounds the blast radius to the operator's machine. Upgrade to praisonai 4.6.40 and praisonaiagents 1.6.40 immediately; teams unable to patch should sanitize all prompt inputs to strip @url: directives targeting RFC1918 and loopback ranges.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity SSRF bounded by the local attack vector — the attacker must influence prompt text reaching the CLI on the operator's machine. Exploitability is trivial once that precondition is met: no special knowledge, no elevated privileges, and a working proof-of-concept is published in the advisory. Confidentiality impact is HIGH because local services commonly run unauthenticated on loopback — Jupyter, MLflow, Grafana, Ollama, and cloud metadata endpoints (AWS IMDSv1, GCP metadata) are all in scope and frequently expose API keys, OAuth tokens, or internal configuration. Risk escalates significantly in multi-user or pipeline contexts where external documents or user-submitted text flows unfiltered into the CLI. No EPSS data, no active exploitation, and no KEV listing keep overall risk at medium for isolated deployments.

How does the attack unfold?

Prompt Injection

Attacker embeds @url:http://localhost:PORT/ into prompt text that reaches the PraisonAI direct-prompt CLI, either directly or via a document or template processed by the pipeline.

AML.T0051.000

SSRF Execution

MentionsParser.process() parses the @url: directive and calls urllib.request.urlopen() against the loopback address with no private-range or metadata-service restriction, completing the HTTP request.

AML.T0053

Context Poisoning

The HTTP response body from the local service is prepended to the model's prompt context, injecting attacker-chosen local data before the LLM receives the legitimate task.

AML.T0080

Data Exfiltration

Injected content — IAM credentials, API keys, internal configs, or service data — surfaces in model output, logs, traces, or shared knowledge bases where it becomes accessible to the attacker.

AML.T0037

Prompt Injection

Attacker embeds @url:http://localhost:PORT/ into prompt text that reaches the PraisonAI direct-prompt CLI, either directly or via a document or template processed by the pipeline.

AML.T0051.000

SSRF Execution

MentionsParser.process() parses the @url: directive and calls urllib.request.urlopen() against the loopback address with no private-range or metadata-service restriction, completing the HTTP request.

AML.T0053

Context Poisoning

The HTTP response body from the local service is prepended to the model's prompt context, injecting attacker-chosen local data before the LLM receives the legitimate task.

AML.T0080

Data Exfiltration

Injected content — IAM credentials, API keys, internal configs, or service data — surfaces in model output, logs, traces, or shared knowledge bases where it becomes accessible to the attacker.

AML.T0037

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 4.6.39	`4.6.40`
1 dependents 68% patched ~14d to patch Full package profile →
PraisonAI Agents	pip	<= 1.6.39	`1.6.40`
11 dependents 65% patched ~6d to patch Full package profile →

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch immediately: upgrade praisonai to >=4.6.40 and praisonaiagents to >=1.6.40, which introduce URL restrictions.
If patching is not immediately possible, add input sanitization to strip or reject @url: directives — especially those matching loopback (127.0.0.1, localhost, localhost.), link-local (169.254.x.x), and RFC1918 ranges (10.x, 172.16-31.x, 192.168.x) — before passing prompt text to the CLI.
Audit all prompt sources feeding the PraisonAI direct-prompt CLI and identify any code paths where externally-controlled text can reach it unfiltered.
Review process logs for unexpected outbound HTTP connections from PraisonAI processes to loopback or private addresses.
Where feasible, run AI agent processes with network namespace restrictions or egress filtering that prevents loopback HTTP fetches from agent processes.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Prompt Injection Data Extraction Data Leakage Agent Framework AML.T0037 - Data from Local System AML.T0051.000 - Direct AML.T0051.001 - Indirect AML.T0053 - AI Agent Tool Invocation AML.T0080 - AI Agent Context Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - AI system design and development

NIST AI RMF

GOVERN 6.1 - AI risk policies and procedures

OWASP LLM Top 10

LLM01:2025 - Prompt Injection LLM02:2025 - Sensitive Information Disclosure LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47395?

PraisonAI's direct-prompt CLI blindly fetches any URL embedded in @url: mentions — including loopback addresses like localhost and 127.0.0.1 — and injects the HTTP response body directly into the model's prompt context before the LLM runs. Any workflow that accepts externally-controlled input (shared scripts, document pipelines, user-submitted prompts) becomes an SSRF vector: an attacker who can inject @url:http://localhost:8080/ into a prompt will silently harvest local admin panels, development servers, Jupyter instances, or cloud metadata endpoints, with the data surfacing in model output, logs, or traces. The CVSS vector (AV:L/AC:L/PR:N/UI:R/C:H) reflects low attack complexity and high confidentiality impact with no privileges required — though the local attack vector bounds the blast radius to the operator's machine. Upgrade to praisonai 4.6.40 and praisonaiagents 1.6.40 immediately; teams unable to patch should sanitize all prompt inputs to strip @url: directives targeting RFC1918 and loopback ranges.

Is CVE-2026-47395 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-47395, increasing the risk of exploitation.

How to fix CVE-2026-47395?

1. Patch immediately: upgrade praisonai to >=4.6.40 and praisonaiagents to >=1.6.40, which introduce URL restrictions. 2. If patching is not immediately possible, add input sanitization to strip or reject @url: directives — especially those matching loopback (127.0.0.1, localhost, localhost.), link-local (169.254.x.x), and RFC1918 ranges (10.x, 172.16-31.x, 192.168.x) — before passing prompt text to the CLI. 3. Audit all prompt sources feeding the PraisonAI direct-prompt CLI and identify any code paths where externally-controlled text can reach it unfiltered. 4. Review process logs for unexpected outbound HTTP connections from PraisonAI processes to loopback or private addresses. 5. Where feasible, run AI agent processes with network namespace restrictions or egress filtering that prevents loopback HTTP fetches from agent processes.

What systems are affected by CVE-2026-47395?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI CLI tooling, document processing pipelines, model orchestration workflows, local AI development environments.

What is the CVSS score for CVE-2026-47395?

CVE-2026-47395 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI CLI toolingdocument processing pipelinesmodel orchestration workflowslocal AI development environments

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0051.000 Direct

AML.T0051.001 Indirect

AML.T0053 AI Agent Tool Invocation

AML.T0080 AI Agent Context Poisoning

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM01:2025, LLM02:2025, LLM06:2025

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execution begins. If a prompt contains `@url:<http-or-https-url>`, the CLI calls `MentionsParser.process(...)`. The `@url:` handler then performs a direct `urllib.request.urlopen()` request to the attacker-controlled URL and returns the response body. That response body is prepended to the final model prompt context. There is no loopback/private-address restriction, no metadata-service restriction, and no approval gate before the fetch. As a result, attacker-influenced prompt text can cause the operator's machine to fetch localhost-only HTTP resources and inject the response into model context. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a fix.

Exploitation Scenario

An attacker targeting a threat analysis pipeline where analysts pipe external intelligence reports into PraisonAI for summarization embeds @url:http://169.254.169.254/latest/meta-data/iam/security-credentials/analyst-role into a crafted document. When an analyst running on AWS EC2 processes the document, PraisonAI fetches the cloud metadata endpoint and prepends the IAM credential response — including AccessKeyId, SecretAccessKey, and Token — to the model's prompt context. The LLM processes this injected content alongside the legitimate task and may reproduce it verbatim in its summary, which is then logged, posted to a Slack channel, or stored in a shared knowledge base. Alternatively, an attacker embeds @url:http://localhost:11434/api/tags (Ollama) or @url:http://localhost:5000 (MLflow) into a shared analysis template used across a security team, harvesting internal model inventories or experiment metadata from every analyst machine that runs the template.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.