Medium severity · published Apr 9, 2026
CVE-2026-40150
PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praisonaiagents/tools/web_crawl_tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. This allows an attacker (or prompt injection in crawled content) to force the agent to fetch cloud metadata endpoints, internal services, or local files via file:// URLs. This vulnerability is fixed in 1.5.128.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
PraisonAIAgents · MervinPraison
< 1.5.128 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40150
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40150
Exploit
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8f4v-xfm9-3244
More from PraisonAIAgents
9.9
CVE-2026-39888
PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
9.8
CVE-2026-57118
PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
9.8
CVE-2026-57123
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
9.8
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
9.8
CVE-2026-40288
PraisonAI: Critical RCE via `type: job` workflow YAML