CVE-2026-57143: PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxngsearch and the searchweb SearxNG provider pass the LLM-controlled searxngurl parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaiagentsto a version that resolves this vulnerability.Fixed in 1.6.62
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using praisonaiagents before 1.6.62 are exposed when they use the searxng_search tool or the search_web SearxNG provider. The affected searxng_url parameter is LLM-controlled, including through prompt-injected content.
What does an attacker need to exploit this issue?
An attacker needs a way to influence content processed by the LLM so it directs the search tool to an attacker-chosen searxng_url. No authentication or direct network access to the target service is required according to the supplied vector.
What can exploitation expose or enable?
The tool can send requests to internal JSON services, probe whether internal ports are open or closed, and attempt requests to cloud metadata endpoints. JSON returned by reachable services can be placed into the agent context.
What should teams do if they cannot patch immediately?
Restrict or disable use of the searxng_search tool and the SearxNG search_web provider where untrusted or prompt-injectable content can influence tool inputs. Limit the agent runtime's network access to internal services and cloud metadata endpoints.
What version contains the fix?
The issue is fixed in praisonaiagents 1.6.62. Versions prior to 1.6.62 are affected.