Vulnerability Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execution begins. If a prompt contains `@url:<http-or-https-url>`, the CLI calls `MentionsParser.process(...)`. The `@url:` handler then performs a direct `urllib.request.urlopen()` request to the attacker-controlled URL and returns the response body. That response body is prepended to the final model prompt context. There is no loopback/private-address restriction, no metadata-service restriction, and no approval gate before the fetch. As a result, attacker-influenced prompt text can cause the operator's machine to fetch localhost-only HTTP resources and inject the response into model context. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a fix.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/MervinPraison/PraisonAI/commit/b0d8f777528f3253a0cfb0a3ef6545
- https://github.com/MervinPraison/PraisonAI/pull/1684
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5cxw-77wg-jr
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5cxw-77wg-jr
FAQ
What is CVE-2026-47395?
CVE-2026-47395 is a vulnerability with a CVSS score of 5.5 (MEDIUM). PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands `@url:` mentions ...
How severe is CVE-2026-47395?
CVE-2026-47395 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-47395?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.