HighVulnerability
GHSA-4pcv-mg8v-vrgf: PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
- Identifier
- GHSA-4pcv-mg8v-vrgf
- Published
- Record updated
- Affected
- praisonaiagents < 1.6.61
- Fixed in
- 1.6.61
Summary
A server-side request forgery (SSRF) flaw in PraisonAI's SearxNG and search_web tools lets an attacker make the server send requests to arbitrary internal endpoints and return the responses. The searxng_url argument is passed directly to requests.get() with no check on scheme, host, or port, and it is exposed to the LLM as a tool parameter in the default toolset, so prompt injection in ingested content can trigger it. The source states this can expose internal services and, in cloud environments, the instance metadata endpoint at 169.254.169.254 with potential IAM credential exposure.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database