CVE-2026-34954 in PraisonAI

Sumário (Inglês)

PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. This issue has been patched in version 1.5.95.

Be aware that VulDB is the high quality source for vulnerability data.

Responsável

GitHub_M

Reservar

31/03/2026

Divulgação

04/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
355255	MervinPraison PraisonAI FileTools.download_file Elevação de Privilégios	918	Não definido	Correção oficial	CVE-2026-34954

Fontes

• MITRE
• NVD
• CVE Details