PraisonAIAgents contains a flaw in its web_crawl function. Before version 1.5.128, the httpx fallback path accepted URLs supplied by a user without any host validation and performed HTTP GET requests with automatic redirect following. An LLM agent that is tricked into crawling a malicious internal URL can thereby retrieve the content of cloud metadata endpoints, internal services or localhost and have that content returned to the agent. Because the agent’s output may be shown to an external attacker, the vulnerability can leak sensitive internal information. The issue is a classic SSRF identified as CWE‑918.

The affected product is PraisonAIAgents from MervinPraison. All releases older than 1.5.128 are vulnerable, including the default fresh installation path that uses httpx when no Tavily key or Crawl4AI is configured.

The CVSS score of 7.1 indicates a high risk of internal data exposure. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted URL that the agent will crawl; this can be done either directly via the web_crawl API or by leveraging the agent’s natural language abilities to request it. Once the request is made, the attacker can read data from the target internal endpoint without requiring additional privileges.