CVE-2026-34954 in PraisonAI
要約 (英語)
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. This issue has been patched in version 1.5.95.
Be aware that VulDB is the high quality source for vulnerability data.
責任者
GitHub_M
予約する
2026年03月31日
公開
2026年04月04日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 355255 | MervinPraison PraisonAI FileTools.download_file 特権昇格 | 918 | 未定義 | 公式な修正 | CVE-2026-34954 |