PraisonAI’s direct‑prompt CLI expands a special @url: syntax by calling a Python URL opener with no restrictions on the target address or any approval gate. The response from the requested URL is inserted directly into the model’s prompt context. Because the operation lacks loopback or private‑address protection, an attacker can provide a prompt that points to an HTTP resource only reachable from the operator’s own machine, such as a local metadata service or an internal application. The data returned from such a resource becomes part of the prompt that the AI model processes, effectively leaking sensitive information that the operator had not intended to expose. This is a classic confidentiality breach consistent with CWE‑200, the Information Exposure vulnerability.

MervinPraison PraisonAI multi‑agent system and its praisonaiagents package are affected. Versions prior to 4.6.40 of PraisonAI and prior to 1.6.40 of praisonaiagents contain the flaw. The fix was introduced in those listed versions, eliminating unrestricted URL fetching from the @url: handler.

The CVSS score of 5.5 reflects moderate severity, limited primarily to the operator’s environment. The EPSS score is below 1 %, indicating a very low likelihood of active exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious prompt that includes a crafted @url: reference, which can occur if the CLI is exposed to untrusted input or if the attacker compromises the operator’s system to alter the prompt feed. Once triggered, the data is injected immediately, leaving little opportunity for detection.