CVE-2026-34954HIGH 8.6EPSS p33.4%
CVE-2026-34954CVE-2026-34954
praison / praisonaiagents
Description
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. This issue has been patched in version 1.5.95.
Scoring
| CVSS 3.1 | 8.6 (HIGH) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| EPSS | 0.40% probability of exploitation · percentile 33.4% · 2026-08-03T12:00:16Z |
| Published | 2026-04-03 |
| Last modified | 2026-07-24 |
Underlying weaknesses· 1
References
1
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Server-Side Request Forgery (SSRF)cwe-918 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.