GHSA-5cxw-77wg-jrf3: PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

Summary

PraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execution. The `@url:` handler calls `urllib.request.urlopen()` on the given URL with no loopback or private-address restriction and no approval gate, and prepends the response body to the model prompt, so attacker-influenced prompt text can pull localhost-only HTTP resources into model context.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
• HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
• InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database