Based on the description, it is inferred that the attacker can inject a crafted searxng_url value into prompts used by the PraisonAI agent. This causes the agent to issue HTTP requests to arbitrary hosts without validation, and the JSON responses from those requests are incorporated into the agent’s internal context. The attacker can read internal service data, enumerate open ports, and harvest cloud‑metadata, enabling disclosure of sensitive internal information and potentially providing a foothold for further lateral movement.

The flaw appears in MervinPraison praisonaiagents versions older than 1.6.62. All deployments of PraisonAI that include the default SearxNG or search_web provider and allow the insecure searxng_url parameter are affected. The issue has been fixed in praisonaiagents 1.6.62 and later releases.

Based on the description, the likely attack vector is injection of a crafted searxng_url via prompts that the LLM interprets. The CVSS base score of 8.8 highlights a high severity vulnerability. Because the exploit requires injecting content into prompts that the LLM interprets, the attack surface is limited to environments where the agent can receive crafted inputs. Nevertheless, a remote attacker who can influence the agent’s prompts can trigger arbitrary HTTP requests, potentially accessing internal endpoints. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the absence of an EPSS score does not reduce the risk posed by the high CVSS rating or the practical exposure described.