PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL

The SSRF vulnerability in praisonaiagents arises from insufficient validation of the url parameter within the FileTools.downloadfile() function. The code directly passes this unvalidated URL to httpx.stream() with followredirects=True, enabling an attacker to control the destination of the request. This allows access to internal resources that should be inaccessible from the outside. Attackers could potentially retrieve sensitive data from cloud metadata services (e.g., AWS instance IDs, Azure credentials), access internal databases, or even trigger actions on other internal systems. The blast radius extends to any service accessible from the server running praisonaiagents, making it a significant security risk.

Organizations deploying praisonaiagents in environments with access to sensitive internal services or cloud metadata are at significant risk. This includes those using praisonaiagents for data processing, automation, or integration with cloud platforms. Shared hosting environments where multiple users share the same server are also particularly vulnerable, as a compromised user could potentially exploit this vulnerability to access resources belonging to other users.

• python / server:

import os
import subprocess

def check_praisonaiagents_version():
    try:
        result = subprocess.check_output(['pip', 'show', 'praisonaiagents'], stderr=subprocess.STDOUT, text=True)
        for line in result.splitlines():
            if line.startswith('Version:'):
                version = line.split(':')[1].strip()
                if version <= '1.5.94':
                    print(f"Vulnerable version detected: {version}")
                else:
                    print(f"Safe version detected: {version}")
                return
    except FileNotFoundError:
        print("praisonaiagents not found.")

check_praisonaiagents_version()

1. 2026-04-01Disclosure

   disclosure

1. 已保留2026-03-31
2. 发布日期2026-04-01
3. 修改日期2026-04-06
4. EPSS 更新日期2026-04-11

The primary mitigation for CVE-2026-34954 is to upgrade to version 1.5.95 or later of praisonaiagents. This version includes the necessary validation to prevent the SSRF vulnerability. If an immediate upgrade is not feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter outbound requests and block those targeting internal or sensitive endpoints. Additionally, restrict network access to the server running praisonaiagents to only necessary ports and services. Carefully review and restrict the permissions granted to the user account running the praisonaiagents process to minimize potential damage. After upgrading, confirm the fix by attempting to trigger the download with a URL pointing to an internal service; the request should be blocked.