The web_crawl() function in Praison AIAgents accepts user‑supplied URLs without any validation. The lack of scheme allowlisting, hostname/IP blocklisting, or private network checks lets an attacker or a malicious prompt inject an URL that points to internal services or local files. Attacks can thus read confidential files or access cloud metadata endpoints, leading to significant confidentiality breaches.

Praison AIAgents from MervinPraison is affected. Versions prior to 1.5.128 contain the vulnerability; the issue is fixed in 1.5.128 and later releases.

The CVSS score of 7.7 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires the attacker to supply a crafted URL to the agent’s web_crawl tool or to inject malicious content that triggers such a call. Because no network restrictions exist, an internal attacker or one who can influence prompts can exploit this to read local files or reach internal network resources.