GHSA-5cxw-77wg-jrf3: PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Summary
PraisonAI's CLI automatically expands @url mentions in prompts by making HTTP requests to any URL without restrictions, including localhost addresses. This allows an attacker to embed a malicious prompt with `@url:http://localhost:8766/` to make the user's machine fetch local-only HTTP resources (like metadata services or internal APIs) and inject the response into the model's context, creating a local SSRF (server-side request forgery, where a system is tricked into making requests to internal networks) vulnerability.
Vulnerability Details
EPSS: 0.0%
Yes
May 29, 2026
Classification
Taxonomy References
Affected Vendors
Affected Packages
Related Issues
Original source: https://github.com/advisories/GHSA-5cxw-77wg-jrf3
First tracked: May 29, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 92%