Skip to content
Threat Feed
Subscribe

Product

Praisonaiagents (< 1.6.61)

1 brief RSS
high threat

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web Tools via Attacker-Controlled searxng_url Parameter

A Server-Side Request Forgery (SSRF) vulnerability in PraisonAI's `praisonaiagents` package (versions prior to 1.6.61), specifically within the `searxng_search` and `search_web` tools, allows an attacker to exploit prompt injection by controlling the `searxng_url` parameter, enabling the server to make requests to arbitrary internal endpoints, read responses, perform network enumeration, and potentially expose cloud instance credentials.

exploited praisonaiagents ssrf llm-agent prompt-injection praisonai python ghsa
2r 6t 1i