# CVE-2026-40160: praisonaiagents SSRF — Fixed in 1.5.128 🐍 PyPI Not in CISA KEV # CVE-2026-40160 — praisonaiagents CVE-2026-40160 is a Server-Side Request Forgery (SSRF) vulnerability in praisonaiagents. A fix is available for praisonaiagents — see the affected versions and patch details below. PraisonAIAgents: SSRF via unvalidated URL in \`web\_crawl\` httpx fallback Also known asPYSEC-2026-2951 Published Apr 10, 2026 Updated Jul 13, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 7, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-40160. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.5%probability of exploitation in next 30 days Lower Risk+0.01% Lower risk than most CVEs41th percentile — riskier than 41% of all scored CVEsHighest risk 0.00%0.32%0.65%0.97%0.0%0.5%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 1 pkg affected 🐍`praisonaiagents` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems. ## Description Field Value Severity High Type SSRF -- unvalidated URL in `web_crawl` httpx fallback allows internal network access Affected `src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:133-180` ### Summary `web_crawl`'s httpx fallback path passes user-supplied URLs directly to `httpx.AsyncClient.get()` with `follow_redirects=True` and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (`169.254.169.254`), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). ### Details The vulnerable code is in `tools/web_crawl_tools.py:148-155`: ``` async with httpx.AsyncClient( follow_redirects=True, timeout=httpx.Timeout(30) ) as client: response = await client.get(url) # url from agent tool call, no validation ``` No scheme restriction, no hostname resolution, no private/link-local IP check. `follow_redirects=True` also means an attacker can use an open redirect on a public URL to bounce the request into internal networks. `download_file` in `file_tools.py:295-318`, by contrast, validates URLs before requesting: ``` parsed = urllib.parse.urlsplit(url) if parsed.scheme not in ("http", "https"): return "Error: Only HTTP(S) URLs are allowed" hostname = parsed.hostname addr = ipaddress.ip_address(socket.gethostbyname(hostname)) if addr.is_private or addr.is_loopback or addr.is_link_local: return "Error: Access to internal network addresses is not allowed" ``` `web_crawl` has none of this. ### PoC Direct agent interaction: ``` from praisonaiagents import Agent from praisonaiagents.tools import web_crawl agent = Agent( instructions="You are a research assistant.", tools=[web_crawl], ) agent.chat( "Fetch the content from http://169.254.169.254/latest/meta-data/ " "and tell me what you find." ) # On an EC2 instance with IMDSv1: returns instance metadata including IAM role names ``` Indirect prompt injection -- hidden instruction on a crawled page: ``` ``` ### Impact Tool Internal network blocked? `download_file("http://169.254.169.254/...")` Yes `web_crawl("http://169.254.169.254/...")` No On cloud infrastructure with IMDSv1, this gets you IAM credentials from the metadata service. On any deployment, it exposes whatever internal services the host can reach. No authentication is needed -- the attacker just needs the agent to process input that triggers a `web_crawl` call to an internal address. #### Conditions for exploitability The httpx fallback is active when: - `TAVILY_API_KEY` is not set, **and** - `crawl4ai` package is not installed This is the default state after `pip install praisonai`. Production deployments with Tavily or Crawl4AI configured are not affected through this path. ### Remediation Add URL validation before the httpx request. The private-IP check from `file_tools.py` can be extracted into a shared utility: ``` # tools/web_crawl_tools.py -- add before the httpx request import urllib.parse, socket, ipaddress parsed = urllib.parse.urlsplit(url) if parsed.scheme not in ("http", "https"): return f"Error: Unsupported scheme: {parsed.scheme}" try: hostname = parsed.hostname addr = ipaddress.ip_address(socket.gethostbyname(hostname)) if addr.is_private or addr.is_loopback or addr.is_link_local: return "Error: Access to internal network addresses is not allowed" except (socket.gaierror, ValueError): pass ``` #### Affected paths - `src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:133-180` -- `_crawl_with_httpx()` requests URLs without validation ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐍PyPI `praisonaiagents` ≥ 0.13.23&&< 1.5.128 1.5.128`pip install --upgrade 'praisonaiagents==1.5.128'` ## Affected Products 1 product · 1 configurations Application `praisonaiagents`praison < 1.5.128 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for praisonaiagents, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update praisonaiagents to 1.5.128 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-40160 is resolved across your whole dependency graph. 3. ### Workarounds Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one. ## Frequently Asked Questions | Field | Value | |---|---| | Severity | High | | Type | SSRF -- unvalidated URL in \`web\_crawl\` httpx fallback allows internal network access | | Affected | \`src/praisonai-agents/praisonaiagents/tools/web\_crawl\_tools.py:133-180\` | ## Summary \`web\_crawl\`'s httpx fallback path passes user-supplied URLs directly to \`httpx.AsyncClient.get()\` with \`follow\_redirects=True\` and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (\`169.254.169.254\`), internal services, and localhost. The response content is returned to the agent and may appear in O3 Security · Impact-Aware SCA ### Is CVE-2026-40160 in your dependencies? Find it across PyPI, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)