CVE-2026-57143

8.8 Élevée

Publiée le 12/10/2026 à 21:16 · Modifiée le 16/10/2026 à 22:04 · Analyse NVD reportée · Source : security-advisories@github.com

Description

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.

Traduire en français

Produits concernés

MervinPraison praisonaiagents

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L`

Faiblesses (CWE)

CWE-20
CWE-918

Références

https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories